fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites#14905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-sales merged 7 commits into from
Sep 3, 2026
Merged

fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites #14905

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6d3509a
fix(sharing): gate the share-link route probe on publicSharing.enable…
os-sales Sep 3, 2026
4c1c6c3
test(sharing): pin the gated probe at both sites, both shapes, byte-e…
os-sales Sep 3, 2026
8ed0f4d
chore(sharing): changeset + re-anchor the system-context census page
os-sales Sep 3, 2026
261cfb8
test(sharing): declare the fixture's publicSharing block in the envel…
os-sales Sep 3, 2026
b0afa4d
docs(runtime): cite the real test file in the share-link mirror docblock
claude Sep 3, 2026
889e30d
test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites
claude Sep 3, 2026
43d3b2a
Merge remote-tracking branch 'origin/main' into claude/issue-14637-sh…
claude Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 82 additions & 0 deletions .changeset/share-link-probe-policy-gate.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
---
"@objectstack/plugin-sharing": minor
"@objectstack/runtime": minor
---

fix(sharing): gate the share-link route probe on `publicSharing.enabled`, at both probe sites (#14637)

**BREAKING** runtime behaviour change on a published HTTP path:
`GET /api/v1/share-links/:token/resolve` answers `404 INVALID_OR_EXPIRED` where
it used to answer `401 NEEDS_PASSWORD` / `401 WRONG_PASSWORD` /
`401 SIGN_IN_REQUIRED` / `410 EXPIRED_OR_REVOKED`, for every link whose object
has `publicSharing.enabled` switched off. Shipped as `minor` under the repo's
launch-window convention (a breaking change does not burn a major while the
stack is in lockstep). No published export is added, removed or re-shaped; the
level carries the breaking banner, not a surface change.

#14033 made `publicSharing.enabled` a standing policy: `resolveToken()` re-reads
the object's current block on every redemption and refuses a switched-off link
with the same undifferentiated `null` a revoked, expired, unknown or ineligible
token gets — because, in that gate's own words, for a caller who may hold
nothing but a token a distinguishable "sharing is off for this object" is an
**existence oracle**.

The HTTP layer above it then re-opened exactly that oracle. Both share-link
surfaces run a row probe after `resolveToken()` returns null, to answer with a
more useful status, and both answered from the `sys_share_link` row with no
knowledge of the object's block. So an anonymous caller could still tell a
real-but-switched-off token from an unknown one three ways: a row carrying
`password_hash` drew `401 NEEDS_PASSWORD`, the same row with any password drew
`401 WRONG_PASSWORD` — including a **correct** password, which is both an oracle
and a lie, since that link can serve nothing — and a row with
`audience: 'signed_in'` drew `401 SIGN_IN_REQUIRED`. A security property stated
in one layer and defeated in the layer above it is worse than one never claimed,
because the next reader believes the comment.

**What changed.** Both probes read the object's standing policy before they
answer from the row, and when the block is off every arm falls through to the
generic `404 INVALID_OR_EXPIRED` that unknown, revoked, expired and ineligible
tokens already give — byte-for-byte the answer a token that never existed
receives. The `410 EXPIRED_OR_REVOKED` arm is included: gating only the two 401
arms would leave a third class of link answer and a rule about which arms are
gated. An object whose schema the engine cannot answer for is `enabled: false`
by `getPolicy`'s definition and is refused the same way — fail-closed, the same
definition `createLink` and `resolveToken` already use.

The fix lands at **both** sites in one change, because the probe exists twice:
`plugin-sharing`'s REST routes, and the `/share-links` dispatcher domain in
`@objectstack/runtime` that is the designed primary surface for cloud's
per-environment kernels (`registerShareLinkRoutes: false`). Fixing one would
have moved the oracle to whichever embedding uses the other.

**Nothing else moves.** With the block ON, every refusal is exactly what it was:
`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED` and `EXPIRED_OR_REVOKED`
are unchanged in status, code and message, and a correct password or a signed-in
viewer still resolves the record. Mint-time behaviour is untouched, no
`sys_share_link` row is written or read differently, and no error code is added
or retired.

**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
changes, for links on a switched-off object only — and the measured consumer
branches on status alone. On the objectui console at `67dadd6`,
`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
`res.status` and never on the body's error code, so:

- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
rendered the password prompt and now render the 404 copy, "This link is
invalid or no longer available.";
- the 410 arm rendered "This link has expired or was revoked." and now renders
that same 404 copy.

Both shifts are the intended outcome and were accepted with the ruling: a
correct password on such a link yields nothing, so prompting for one teaches the
holder to open a door that is bricked up, and "expired or revoked" is a claim
about a token whose existence the caller must not be able to confirm. Links on
objects whose block is on are unaffected — prompt, 410 copy and 200 render
included.

Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
adopting option A over option B (keep the 401 and document the accepted oracle)
and option C (gate only the two 401 arms, rejected as proliferation).

<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, type, default and accept-set, and this change is only WHICH HTTP STATUS the route layer answers with while that switch is off. There is no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform on any consumer — a deployment that wants the 401 affordance back enables the object's block, which is an authoring decision, not a migration. -->
2 changes: 1 addition & 1 deletion content/docs/permissions/system-context.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 106 sites**.
| 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
| 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
| 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
| 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:165`, `:390` |

Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites#14905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-sales
merged 7 commits into

from

Sep 3, 2026
 Merged


fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites
#14905
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6d3509a

fix(sharing): gate the share-link route probe on publicSharing.enable…


os-sales Sep 3, 2026
4c1c6c3

test(sharing): pin the gated probe at both sites, both shapes, byte-e…


os-sales Sep 3, 2026
8ed0f4d

chore(sharing): changeset + re-anchor the system-context census page


os-sales Sep 3, 2026
261cfb8

test(sharing): declare the fixture's publicSharing block in the envel…


os-sales Sep 3, 2026
b0afa4d

docs(runtime): cite the real test file in the share-link mirror docblock


claude Sep 3, 2026
889e30d

test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites


claude Sep 3, 2026
43d3b2a

Merge remote-tracking branch 'origin/main' into claude/issue-14637-sh…


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


82 changes: 82 additions & 0 deletions
.changeset/share-link-probe-policy-gate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
---
"@objectstack/plugin-sharing": minor
"@objectstack/runtime": minor
---

fix(sharing): gate the share-link route probe on `publicSharing.enabled`, at both probe sites (#14637)

**BREAKING** runtime behaviour change on a published HTTP path:
`GET /api/v1/share-links/:token/resolve` answers `404 INVALID_OR_EXPIRED` where
it used to answer `401 NEEDS_PASSWORD` / `401 WRONG_PASSWORD` /
`401 SIGN_IN_REQUIRED` / `410 EXPIRED_OR_REVOKED`, for every link whose object
has `publicSharing.enabled` switched off. Shipped as `minor` under the repo's
launch-window convention (a breaking change does not burn a major while the
stack is in lockstep). No published export is added, removed or re-shaped; the
level carries the breaking banner, not a surface change.

#14033 made `publicSharing.enabled` a standing policy: `resolveToken()` re-reads
the object's current block on every redemption and refuses a switched-off link
with the same undifferentiated `null` a revoked, expired, unknown or ineligible
token gets — because, in that gate's own words, for a caller who may hold
nothing but a token a distinguishable "sharing is off for this object" is an
**existence oracle**.

The HTTP layer above it then re-opened exactly that oracle. Both share-link
surfaces run a row probe after `resolveToken()` returns null, to answer with a
more useful status, and both answered from the `sys_share_link` row with no
knowledge of the object's block. So an anonymous caller could still tell a
real-but-switched-off token from an unknown one three ways: a row carrying
`password_hash` drew `401 NEEDS_PASSWORD`, the same row with any password drew
`401 WRONG_PASSWORD` — including a **correct** password, which is both an oracle
and a lie, since that link can serve nothing — and a row with
`audience: 'signed_in'` drew `401 SIGN_IN_REQUIRED`. A security property stated
in one layer and defeated in the layer above it is worse than one never claimed,
because the next reader believes the comment.

**What changed.** Both probes read the object's standing policy before they
answer from the row, and when the block is off every arm falls through to the
generic `404 INVALID_OR_EXPIRED` that unknown, revoked, expired and ineligible
tokens already give — byte-for-byte the answer a token that never existed
receives. The `410 EXPIRED_OR_REVOKED` arm is included: gating only the two 401
arms would leave a third class of link answer and a rule about which arms are
gated. An object whose schema the engine cannot answer for is `enabled: false`
by `getPolicy`'s definition and is refused the same way — fail-closed, the same
definition `createLink` and `resolveToken` already use.

The fix lands at **both** sites in one change, because the probe exists twice:
`plugin-sharing`'s REST routes, and the `/share-links` dispatcher domain in
`@objectstack/runtime` that is the designed primary surface for cloud's
per-environment kernels (`registerShareLinkRoutes: false`). Fixing one would
have moved the oracle to whichever embedding uses the other.

**Nothing else moves.** With the block ON, every refusal is exactly what it was:
`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED` and `EXPIRED_OR_REVOKED`
are unchanged in status, code and message, and a correct password or a signed-in
viewer still resolves the record. Mint-time behaviour is untouched, no
`sys_share_link` row is written or read differently, and no error code is added
or retired.

**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
changes, for links on a switched-off object only — and the measured consumer
branches on status alone. On the objectui console at `67dadd6`,
`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
`res.status` and never on the body's error code, so:

- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
 rendered the password prompt and now render the 404 copy, "This link is
 invalid or no longer available.";
- the 410 arm rendered "This link has expired or was revoked." and now renders
 that same 404 copy.

Both shifts are the intended outcome and were accepted with the ruling: a
correct password on such a link yields nothing, so prompting for one teaches the
holder to open a door that is bricked up, and "expired or revoked" is a claim
about a token whose existence the caller must not be able to confirm. Links on
objects whose block is on are unaffected — prompt, 410 copy and 200 render
included.

Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
adopting option A over option B (keep the 401 and document the accepted oracle)
and option C (gate only the two 401 arms, rejected as proliferation).

<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, type, default and accept-set, and this change is only WHICH HTTP STATUS the route layer answers with while that switch is off. There is no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform on any consumer — a deployment that wants the 401 affordance back enables the object's block, which is an authoring decision, not a migration. -->

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 106 sites**.
| 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
| 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
| 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
| 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:165`, `:390` |

Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites#14905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-sales
merged 7 commits into

from

Sep 3, 2026
 Merged


fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites
#14905
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6d3509a

fix(sharing): gate the share-link route probe on publicSharing.enable…


os-sales Sep 3, 2026
4c1c6c3

test(sharing): pin the gated probe at both sites, both shapes, byte-e…


os-sales Sep 3, 2026
8ed0f4d

chore(sharing): changeset + re-anchor the system-context census page


os-sales Sep 3, 2026
261cfb8

test(sharing): declare the fixture's publicSharing block in the envel…


os-sales Sep 3, 2026
b0afa4d

docs(runtime): cite the real test file in the share-link mirror docblock


claude Sep 3, 2026
889e30d

test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites


claude Sep 3, 2026
43d3b2a

Merge remote-tracking branch 'origin/main' into claude/issue-14637-sh…


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


82 changes: 82 additions & 0 deletions
.changeset/share-link-probe-policy-gate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
---
"@objectstack/plugin-sharing": minor
"@objectstack/runtime": minor
---

fix(sharing): gate the share-link route probe on `publicSharing.enabled`, at both probe sites (#14637)

**BREAKING** runtime behaviour change on a published HTTP path:
`GET /api/v1/share-links/:token/resolve` answers `404 INVALID_OR_EXPIRED` where
it used to answer `401 NEEDS_PASSWORD` / `401 WRONG_PASSWORD` /
`401 SIGN_IN_REQUIRED` / `410 EXPIRED_OR_REVOKED`, for every link whose object
has `publicSharing.enabled` switched off. Shipped as `minor` under the repo's
launch-window convention (a breaking change does not burn a major while the
stack is in lockstep). No published export is added, removed or re-shaped; the
level carries the breaking banner, not a surface change.

#14033 made `publicSharing.enabled` a standing policy: `resolveToken()` re-reads
the object's current block on every redemption and refuses a switched-off link
with the same undifferentiated `null` a revoked, expired, unknown or ineligible
token gets — because, in that gate's own words, for a caller who may hold
nothing but a token a distinguishable "sharing is off for this object" is an
**existence oracle**.

The HTTP layer above it then re-opened exactly that oracle. Both share-link
surfaces run a row probe after `resolveToken()` returns null, to answer with a
more useful status, and both answered from the `sys_share_link` row with no
knowledge of the object's block. So an anonymous caller could still tell a
real-but-switched-off token from an unknown one three ways: a row carrying
`password_hash` drew `401 NEEDS_PASSWORD`, the same row with any password drew
`401 WRONG_PASSWORD` — including a **correct** password, which is both an oracle
and a lie, since that link can serve nothing — and a row with
`audience: 'signed_in'` drew `401 SIGN_IN_REQUIRED`. A security property stated
in one layer and defeated in the layer above it is worse than one never claimed,
because the next reader believes the comment.

**What changed.** Both probes read the object's standing policy before they
answer from the row, and when the block is off every arm falls through to the
generic `404 INVALID_OR_EXPIRED` that unknown, revoked, expired and ineligible
tokens already give — byte-for-byte the answer a token that never existed
receives. The `410 EXPIRED_OR_REVOKED` arm is included: gating only the two 401
arms would leave a third class of link answer and a rule about which arms are
gated. An object whose schema the engine cannot answer for is `enabled: false`
by `getPolicy`'s definition and is refused the same way — fail-closed, the same
definition `createLink` and `resolveToken` already use.

The fix lands at **both** sites in one change, because the probe exists twice:
`plugin-sharing`'s REST routes, and the `/share-links` dispatcher domain in
`@objectstack/runtime` that is the designed primary surface for cloud's
per-environment kernels (`registerShareLinkRoutes: false`). Fixing one would
have moved the oracle to whichever embedding uses the other.

**Nothing else moves.** With the block ON, every refusal is exactly what it was:
`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED` and `EXPIRED_OR_REVOKED`
are unchanged in status, code and message, and a correct password or a signed-in
viewer still resolves the record. Mint-time behaviour is untouched, no
`sys_share_link` row is written or read differently, and no error code is added
or retired.

**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
changes, for links on a switched-off object only — and the measured consumer
branches on status alone. On the objectui console at `67dadd6`,
`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
`res.status` and never on the body's error code, so:

- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
 rendered the password prompt and now render the 404 copy, "This link is
 invalid or no longer available.";
- the 410 arm rendered "This link has expired or was revoked." and now renders
 that same 404 copy.

Both shifts are the intended outcome and were accepted with the ruling: a
correct password on such a link yields nothing, so prompting for one teaches the
holder to open a door that is bricked up, and "expired or revoked" is a claim
about a token whose existence the caller must not be able to confirm. Links on
objects whose block is on are unaffected — prompt, 410 copy and 200 render
included.

Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
adopting option A over option B (keep the 401 and document the accepted oracle)
and option C (gate only the two 401 arms, rejected as proliferation).

<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, type, default and accept-set, and this change is only WHICH HTTP STATUS the route layer answers with while that switch is off. There is no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform on any consumer — a deployment that wants the 401 affordance back enables the object's block, which is an authoring decision, not a migration. -->

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 106 sites**.
| 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
| 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
| 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
| 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:165`, `:390` |

Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites#14905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-sales
merged 7 commits into

from

Sep 3, 2026
 Merged


fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites
#14905
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6d3509a

fix(sharing): gate the share-link route probe on publicSharing.enable…


os-sales Sep 3, 2026
4c1c6c3

test(sharing): pin the gated probe at both sites, both shapes, byte-e…


os-sales Sep 3, 2026
8ed0f4d

chore(sharing): changeset + re-anchor the system-context census page


os-sales Sep 3, 2026
261cfb8

test(sharing): declare the fixture's publicSharing block in the envel…


os-sales Sep 3, 2026
b0afa4d

docs(runtime): cite the real test file in the share-link mirror docblock


claude Sep 3, 2026
889e30d

test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites


claude Sep 3, 2026
43d3b2a

Merge remote-tracking branch 'origin/main' into claude/issue-14637-sh…


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


82 changes: 82 additions & 0 deletions
.changeset/share-link-probe-policy-gate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
---
"@objectstack/plugin-sharing": minor
"@objectstack/runtime": minor
---

fix(sharing): gate the share-link route probe on `publicSharing.enabled`, at both probe sites (#14637)

**BREAKING** runtime behaviour change on a published HTTP path:
`GET /api/v1/share-links/:token/resolve` answers `404 INVALID_OR_EXPIRED` where
it used to answer `401 NEEDS_PASSWORD` / `401 WRONG_PASSWORD` /
`401 SIGN_IN_REQUIRED` / `410 EXPIRED_OR_REVOKED`, for every link whose object
has `publicSharing.enabled` switched off. Shipped as `minor` under the repo's
launch-window convention (a breaking change does not burn a major while the
stack is in lockstep). No published export is added, removed or re-shaped; the
level carries the breaking banner, not a surface change.

#14033 made `publicSharing.enabled` a standing policy: `resolveToken()` re-reads
the object's current block on every redemption and refuses a switched-off link
with the same undifferentiated `null` a revoked, expired, unknown or ineligible
token gets — because, in that gate's own words, for a caller who may hold
nothing but a token a distinguishable "sharing is off for this object" is an
**existence oracle**.

The HTTP layer above it then re-opened exactly that oracle. Both share-link
surfaces run a row probe after `resolveToken()` returns null, to answer with a
more useful status, and both answered from the `sys_share_link` row with no
knowledge of the object's block. So an anonymous caller could still tell a
real-but-switched-off token from an unknown one three ways: a row carrying
`password_hash` drew `401 NEEDS_PASSWORD`, the same row with any password drew
`401 WRONG_PASSWORD` — including a **correct** password, which is both an oracle
and a lie, since that link can serve nothing — and a row with
`audience: 'signed_in'` drew `401 SIGN_IN_REQUIRED`. A security property stated
in one layer and defeated in the layer above it is worse than one never claimed,
because the next reader believes the comment.

**What changed.** Both probes read the object's standing policy before they
answer from the row, and when the block is off every arm falls through to the
generic `404 INVALID_OR_EXPIRED` that unknown, revoked, expired and ineligible
tokens already give — byte-for-byte the answer a token that never existed
receives. The `410 EXPIRED_OR_REVOKED` arm is included: gating only the two 401
arms would leave a third class of link answer and a rule about which arms are
gated. An object whose schema the engine cannot answer for is `enabled: false`
by `getPolicy`'s definition and is refused the same way — fail-closed, the same
definition `createLink` and `resolveToken` already use.

The fix lands at **both** sites in one change, because the probe exists twice:
`plugin-sharing`'s REST routes, and the `/share-links` dispatcher domain in
`@objectstack/runtime` that is the designed primary surface for cloud's
per-environment kernels (`registerShareLinkRoutes: false`). Fixing one would
have moved the oracle to whichever embedding uses the other.

**Nothing else moves.** With the block ON, every refusal is exactly what it was:
`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED` and `EXPIRED_OR_REVOKED`
are unchanged in status, code and message, and a correct password or a signed-in
viewer still resolves the record. Mint-time behaviour is untouched, no
`sys_share_link` row is written or read differently, and no error code is added
or retired.

**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
changes, for links on a switched-off object only — and the measured consumer
branches on status alone. On the objectui console at `67dadd6`,
`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
`res.status` and never on the body's error code, so:

- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
 rendered the password prompt and now render the 404 copy, "This link is
 invalid or no longer available.";
- the 410 arm rendered "This link has expired or was revoked." and now renders
 that same 404 copy.

Both shifts are the intended outcome and were accepted with the ruling: a
correct password on such a link yields nothing, so prompting for one teaches the
holder to open a door that is bricked up, and "expired or revoked" is a claim
about a token whose existence the caller must not be able to confirm. Links on
objects whose block is on are unaffected — prompt, 410 copy and 200 render
included.

Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
adopting option A over option B (keep the 401 and document the accepted oracle)
and option C (gate only the two 401 arms, rejected as proliferation).

<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, type, default and accept-set, and this change is only WHICH HTTP STATUS the route layer answers with while that switch is off. There is no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform on any consumer — a deployment that wants the 401 affordance back enables the object's block, which is an authoring decision, not a migration. -->

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 106 sites**.
| 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
| 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
| 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
| 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:165`, `:390` |

Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites#14905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-sales
merged 7 commits into

from

Sep 3, 2026
 Merged


fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites
#14905
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6d3509a

fix(sharing): gate the share-link route probe on publicSharing.enable…


os-sales Sep 3, 2026
4c1c6c3

test(sharing): pin the gated probe at both sites, both shapes, byte-e…


os-sales Sep 3, 2026
8ed0f4d

chore(sharing): changeset + re-anchor the system-context census page


os-sales Sep 3, 2026
261cfb8

test(sharing): declare the fixture's publicSharing block in the envel…


os-sales Sep 3, 2026
b0afa4d

docs(runtime): cite the real test file in the share-link mirror docblock


claude Sep 3, 2026
889e30d

test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites


claude Sep 3, 2026
43d3b2a

Merge remote-tracking branch 'origin/main' into claude/issue-14637-sh…


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


82 changes: 82 additions & 0 deletions
.changeset/share-link-probe-policy-gate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
---
"@objectstack/plugin-sharing": minor
"@objectstack/runtime": minor
---

fix(sharing): gate the share-link route probe on `publicSharing.enabled`, at both probe sites (#14637)

**BREAKING** runtime behaviour change on a published HTTP path:
`GET /api/v1/share-links/:token/resolve` answers `404 INVALID_OR_EXPIRED` where
it used to answer `401 NEEDS_PASSWORD` / `401 WRONG_PASSWORD` /
`401 SIGN_IN_REQUIRED` / `410 EXPIRED_OR_REVOKED`, for every link whose object
has `publicSharing.enabled` switched off. Shipped as `minor` under the repo's
launch-window convention (a breaking change does not burn a major while the
stack is in lockstep). No published export is added, removed or re-shaped; the
level carries the breaking banner, not a surface change.

#14033 made `publicSharing.enabled` a standing policy: `resolveToken()` re-reads
the object's current block on every redemption and refuses a switched-off link
with the same undifferentiated `null` a revoked, expired, unknown or ineligible
token gets — because, in that gate's own words, for a caller who may hold
nothing but a token a distinguishable "sharing is off for this object" is an
**existence oracle**.

The HTTP layer above it then re-opened exactly that oracle. Both share-link
surfaces run a row probe after `resolveToken()` returns null, to answer with a
more useful status, and both answered from the `sys_share_link` row with no
knowledge of the object's block. So an anonymous caller could still tell a
real-but-switched-off token from an unknown one three ways: a row carrying
`password_hash` drew `401 NEEDS_PASSWORD`, the same row with any password drew
`401 WRONG_PASSWORD` — including a **correct** password, which is both an oracle
and a lie, since that link can serve nothing — and a row with
`audience: 'signed_in'` drew `401 SIGN_IN_REQUIRED`. A security property stated
in one layer and defeated in the layer above it is worse than one never claimed,
because the next reader believes the comment.

**What changed.** Both probes read the object's standing policy before they
answer from the row, and when the block is off every arm falls through to the
generic `404 INVALID_OR_EXPIRED` that unknown, revoked, expired and ineligible
tokens already give — byte-for-byte the answer a token that never existed
receives. The `410 EXPIRED_OR_REVOKED` arm is included: gating only the two 401
arms would leave a third class of link answer and a rule about which arms are
gated. An object whose schema the engine cannot answer for is `enabled: false`
by `getPolicy`'s definition and is refused the same way — fail-closed, the same
definition `createLink` and `resolveToken` already use.

The fix lands at **both** sites in one change, because the probe exists twice:
`plugin-sharing`'s REST routes, and the `/share-links` dispatcher domain in
`@objectstack/runtime` that is the designed primary surface for cloud's
per-environment kernels (`registerShareLinkRoutes: false`). Fixing one would
have moved the oracle to whichever embedding uses the other.

**Nothing else moves.** With the block ON, every refusal is exactly what it was:
`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED` and `EXPIRED_OR_REVOKED`
are unchanged in status, code and message, and a correct password or a signed-in
viewer still resolves the record. Mint-time behaviour is untouched, no
`sys_share_link` row is written or read differently, and no error code is added
or retired.

**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
changes, for links on a switched-off object only — and the measured consumer
branches on status alone. On the objectui console at `67dadd6`,
`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
`res.status` and never on the body's error code, so:

- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
 rendered the password prompt and now render the 404 copy, "This link is
 invalid or no longer available.";
- the 410 arm rendered "This link has expired or was revoked." and now renders
 that same 404 copy.

Both shifts are the intended outcome and were accepted with the ruling: a
correct password on such a link yields nothing, so prompting for one teaches the
holder to open a door that is bricked up, and "expired or revoked" is a claim
about a token whose existence the caller must not be able to confirm. Links on
objects whose block is on are unaffected — prompt, 410 copy and 200 render
included.

Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
adopting option A over option B (keep the 401 and document the accepted oracle)
and option C (gate only the two 401 arms, rejected as proliferation).

<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, type, default and accept-set, and this change is only WHICH HTTP STATUS the route layer answers with while that switch is off. There is no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform on any consumer — a deployment that wants the 401 affordance back enables the object's block, which is an authoring decision, not a migration. -->

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 106 sites**.
| 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
| 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
| 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
| 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:165`, `:390` |

Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites#14905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-sales
merged 7 commits into

from

Sep 3, 2026
 Merged


fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites
#14905
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6d3509a

fix(sharing): gate the share-link route probe on publicSharing.enable…


os-sales Sep 3, 2026
4c1c6c3

test(sharing): pin the gated probe at both sites, both shapes, byte-e…


os-sales Sep 3, 2026
8ed0f4d

chore(sharing): changeset + re-anchor the system-context census page


os-sales Sep 3, 2026
261cfb8

test(sharing): declare the fixture's publicSharing block in the envel…


os-sales Sep 3, 2026
b0afa4d

docs(runtime): cite the real test file in the share-link mirror docblock


claude Sep 3, 2026
889e30d

test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites


claude Sep 3, 2026
43d3b2a

Merge remote-tracking branch 'origin/main' into claude/issue-14637-sh…


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


82 changes: 82 additions & 0 deletions
.changeset/share-link-probe-policy-gate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
---
"@objectstack/plugin-sharing": minor
"@objectstack/runtime": minor
---

fix(sharing): gate the share-link route probe on `publicSharing.enabled`, at both probe sites (#14637)

**BREAKING** runtime behaviour change on a published HTTP path:
`GET /api/v1/share-links/:token/resolve` answers `404 INVALID_OR_EXPIRED` where
it used to answer `401 NEEDS_PASSWORD` / `401 WRONG_PASSWORD` /
`401 SIGN_IN_REQUIRED` / `410 EXPIRED_OR_REVOKED`, for every link whose object
has `publicSharing.enabled` switched off. Shipped as `minor` under the repo's
launch-window convention (a breaking change does not burn a major while the
stack is in lockstep). No published export is added, removed or re-shaped; the
level carries the breaking banner, not a surface change.

#14033 made `publicSharing.enabled` a standing policy: `resolveToken()` re-reads
the object's current block on every redemption and refuses a switched-off link
with the same undifferentiated `null` a revoked, expired, unknown or ineligible
token gets — because, in that gate's own words, for a caller who may hold
nothing but a token a distinguishable "sharing is off for this object" is an
**existence oracle**.

The HTTP layer above it then re-opened exactly that oracle. Both share-link
surfaces run a row probe after `resolveToken()` returns null, to answer with a
more useful status, and both answered from the `sys_share_link` row with no
knowledge of the object's block. So an anonymous caller could still tell a
real-but-switched-off token from an unknown one three ways: a row carrying
`password_hash` drew `401 NEEDS_PASSWORD`, the same row with any password drew
`401 WRONG_PASSWORD` — including a **correct** password, which is both an oracle
and a lie, since that link can serve nothing — and a row with
`audience: 'signed_in'` drew `401 SIGN_IN_REQUIRED`. A security property stated
in one layer and defeated in the layer above it is worse than one never claimed,
because the next reader believes the comment.

**What changed.** Both probes read the object's standing policy before they
answer from the row, and when the block is off every arm falls through to the
generic `404 INVALID_OR_EXPIRED` that unknown, revoked, expired and ineligible
tokens already give — byte-for-byte the answer a token that never existed
receives. The `410 EXPIRED_OR_REVOKED` arm is included: gating only the two 401
arms would leave a third class of link answer and a rule about which arms are
gated. An object whose schema the engine cannot answer for is `enabled: false`
by `getPolicy`'s definition and is refused the same way — fail-closed, the same
definition `createLink` and `resolveToken` already use.

The fix lands at **both** sites in one change, because the probe exists twice:
`plugin-sharing`'s REST routes, and the `/share-links` dispatcher domain in
`@objectstack/runtime` that is the designed primary surface for cloud's
per-environment kernels (`registerShareLinkRoutes: false`). Fixing one would
have moved the oracle to whichever embedding uses the other.

**Nothing else moves.** With the block ON, every refusal is exactly what it was:
`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED` and `EXPIRED_OR_REVOKED`
are unchanged in status, code and message, and a correct password or a signed-in
viewer still resolves the record. Mint-time behaviour is untouched, no
`sys_share_link` row is written or read differently, and no error code is added
or retired.

**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
changes, for links on a switched-off object only — and the measured consumer
branches on status alone. On the objectui console at `67dadd6`,
`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
`res.status` and never on the body's error code, so:

- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
 rendered the password prompt and now render the 404 copy, "This link is
 invalid or no longer available.";
- the 410 arm rendered "This link has expired or was revoked." and now renders
 that same 404 copy.

Both shifts are the intended outcome and were accepted with the ruling: a
correct password on such a link yields nothing, so prompting for one teaches the
holder to open a door that is bricked up, and "expired or revoked" is a claim
about a token whose existence the caller must not be able to confirm. Links on
objects whose block is on are unaffected — prompt, 410 copy and 200 render
included.

Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
adopting option A over option B (keep the 401 and document the accepted oracle)
and option C (gate only the two 401 arms, rejected as proliferation).

<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, type, default and accept-set, and this change is only WHICH HTTP STATUS the route layer answers with while that switch is off. There is no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform on any consumer — a deployment that wants the 401 affordance back enables the object's block, which is an authoring decision, not a migration. -->

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 106 sites**.
| 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
| 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
| 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
| 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:165`, `:390` |

Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites#14905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-sales
merged 7 commits into

from

Sep 3, 2026
 Merged


fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites
#14905
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6d3509a

fix(sharing): gate the share-link route probe on publicSharing.enable…


os-sales Sep 3, 2026
4c1c6c3

test(sharing): pin the gated probe at both sites, both shapes, byte-e…


os-sales Sep 3, 2026
8ed0f4d

chore(sharing): changeset + re-anchor the system-context census page


os-sales Sep 3, 2026
261cfb8

test(sharing): declare the fixture's publicSharing block in the envel…


os-sales Sep 3, 2026
b0afa4d

docs(runtime): cite the real test file in the share-link mirror docblock


claude Sep 3, 2026
889e30d

test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites


claude Sep 3, 2026
43d3b2a

Merge remote-tracking branch 'origin/main' into claude/issue-14637-sh…


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


82 changes: 82 additions & 0 deletions
.changeset/share-link-probe-policy-gate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
---
"@objectstack/plugin-sharing": minor
"@objectstack/runtime": minor
---

fix(sharing): gate the share-link route probe on `publicSharing.enabled`, at both probe sites (#14637)

**BREAKING** runtime behaviour change on a published HTTP path:
`GET /api/v1/share-links/:token/resolve` answers `404 INVALID_OR_EXPIRED` where
it used to answer `401 NEEDS_PASSWORD` / `401 WRONG_PASSWORD` /
`401 SIGN_IN_REQUIRED` / `410 EXPIRED_OR_REVOKED`, for every link whose object
has `publicSharing.enabled` switched off. Shipped as `minor` under the repo's
launch-window convention (a breaking change does not burn a major while the
stack is in lockstep). No published export is added, removed or re-shaped; the
level carries the breaking banner, not a surface change.

#14033 made `publicSharing.enabled` a standing policy: `resolveToken()` re-reads
the object's current block on every redemption and refuses a switched-off link
with the same undifferentiated `null` a revoked, expired, unknown or ineligible
token gets — because, in that gate's own words, for a caller who may hold
nothing but a token a distinguishable "sharing is off for this object" is an
**existence oracle**.

The HTTP layer above it then re-opened exactly that oracle. Both share-link
surfaces run a row probe after `resolveToken()` returns null, to answer with a
more useful status, and both answered from the `sys_share_link` row with no
knowledge of the object's block. So an anonymous caller could still tell a
real-but-switched-off token from an unknown one three ways: a row carrying
`password_hash` drew `401 NEEDS_PASSWORD`, the same row with any password drew
`401 WRONG_PASSWORD` — including a **correct** password, which is both an oracle
and a lie, since that link can serve nothing — and a row with
`audience: 'signed_in'` drew `401 SIGN_IN_REQUIRED`. A security property stated
in one layer and defeated in the layer above it is worse than one never claimed,
because the next reader believes the comment.

**What changed.** Both probes read the object's standing policy before they
answer from the row, and when the block is off every arm falls through to the
generic `404 INVALID_OR_EXPIRED` that unknown, revoked, expired and ineligible
tokens already give — byte-for-byte the answer a token that never existed
receives. The `410 EXPIRED_OR_REVOKED` arm is included: gating only the two 401
arms would leave a third class of link answer and a rule about which arms are
gated. An object whose schema the engine cannot answer for is `enabled: false`
by `getPolicy`'s definition and is refused the same way — fail-closed, the same
definition `createLink` and `resolveToken` already use.

The fix lands at **both** sites in one change, because the probe exists twice:
`plugin-sharing`'s REST routes, and the `/share-links` dispatcher domain in
`@objectstack/runtime` that is the designed primary surface for cloud's
per-environment kernels (`registerShareLinkRoutes: false`). Fixing one would
have moved the oracle to whichever embedding uses the other.

**Nothing else moves.** With the block ON, every refusal is exactly what it was:
`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED` and `EXPIRED_OR_REVOKED`
are unchanged in status, code and message, and a correct password or a signed-in
viewer still resolves the record. Mint-time behaviour is untouched, no
`sys_share_link` row is written or read differently, and no error code is added
or retired.

**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
changes, for links on a switched-off object only — and the measured consumer
branches on status alone. On the objectui console at `67dadd6`,
`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
`res.status` and never on the body's error code, so:

- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
 rendered the password prompt and now render the 404 copy, "This link is
 invalid or no longer available.";
- the 410 arm rendered "This link has expired or was revoked." and now renders
 that same 404 copy.

Both shifts are the intended outcome and were accepted with the ruling: a
correct password on such a link yields nothing, so prompting for one teaches the
holder to open a door that is bricked up, and "expired or revoked" is a claim
about a token whose existence the caller must not be able to confirm. Links on
objects whose block is on are unaffected — prompt, 410 copy and 200 render
included.

Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
adopting option A over option B (keep the 401 and document the accepted oracle)
and option C (gate only the two 401 arms, rejected as proliferation).

<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, type, default and accept-set, and this change is only WHICH HTTP STATUS the route layer answers with while that switch is off. There is no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform on any consumer — a deployment that wants the 401 affordance back enables the object's block, which is an authoring decision, not a migration. -->

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 106 sites**.
| 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
| 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
| 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
| 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:165`, `:390` |

Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites#14905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-sales
merged 7 commits into

from

Sep 3, 2026
 Merged


fix(sharing): gate the share-link route probe on publicSharing.enabled, at both probe sites
#14905
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


7 commits


Select commit
Hold shift + click to select a range
6d3509a

fix(sharing): gate the share-link route probe on publicSharing.enable…


os-sales Sep 3, 2026
4c1c6c3

test(sharing): pin the gated probe at both sites, both shapes, byte-e…


os-sales Sep 3, 2026
8ed0f4d

chore(sharing): changeset + re-anchor the system-context census page


os-sales Sep 3, 2026
261cfb8

test(sharing): declare the fixture's publicSharing block in the envel…


os-sales Sep 3, 2026
b0afa4d

docs(runtime): cite the real test file in the share-link mirror docblock


claude Sep 3, 2026
889e30d

test(sharing,runtime): pin the 410 arm's EXPIRED half, at both sites


claude Sep 3, 2026
43d3b2a

Merge remote-tracking branch 'origin/main' into claude/issue-14637-sh…


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


82 changes: 82 additions & 0 deletions
.changeset/share-link-probe-policy-gate.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
---
"@objectstack/plugin-sharing": minor
"@objectstack/runtime": minor
---

fix(sharing): gate the share-link route probe on `publicSharing.enabled`, at both probe sites (#14637)

**BREAKING** runtime behaviour change on a published HTTP path:
`GET /api/v1/share-links/:token/resolve` answers `404 INVALID_OR_EXPIRED` where
it used to answer `401 NEEDS_PASSWORD` / `401 WRONG_PASSWORD` /
`401 SIGN_IN_REQUIRED` / `410 EXPIRED_OR_REVOKED`, for every link whose object
has `publicSharing.enabled` switched off. Shipped as `minor` under the repo's
launch-window convention (a breaking change does not burn a major while the
stack is in lockstep). No published export is added, removed or re-shaped; the
level carries the breaking banner, not a surface change.

#14033 made `publicSharing.enabled` a standing policy: `resolveToken()` re-reads
the object's current block on every redemption and refuses a switched-off link
with the same undifferentiated `null` a revoked, expired, unknown or ineligible
token gets — because, in that gate's own words, for a caller who may hold
nothing but a token a distinguishable "sharing is off for this object" is an
**existence oracle**.

The HTTP layer above it then re-opened exactly that oracle. Both share-link
surfaces run a row probe after `resolveToken()` returns null, to answer with a
more useful status, and both answered from the `sys_share_link` row with no
knowledge of the object's block. So an anonymous caller could still tell a
real-but-switched-off token from an unknown one three ways: a row carrying
`password_hash` drew `401 NEEDS_PASSWORD`, the same row with any password drew
`401 WRONG_PASSWORD` — including a **correct** password, which is both an oracle
and a lie, since that link can serve nothing — and a row with
`audience: 'signed_in'` drew `401 SIGN_IN_REQUIRED`. A security property stated
in one layer and defeated in the layer above it is worse than one never claimed,
because the next reader believes the comment.

**What changed.** Both probes read the object's standing policy before they
answer from the row, and when the block is off every arm falls through to the
generic `404 INVALID_OR_EXPIRED` that unknown, revoked, expired and ineligible
tokens already give — byte-for-byte the answer a token that never existed
receives. The `410 EXPIRED_OR_REVOKED` arm is included: gating only the two 401
arms would leave a third class of link answer and a rule about which arms are
gated. An object whose schema the engine cannot answer for is `enabled: false`
by `getPolicy`'s definition and is refused the same way — fail-closed, the same
definition `createLink` and `resolveToken` already use.

The fix lands at **both** sites in one change, because the probe exists twice:
`plugin-sharing`'s REST routes, and the `/share-links` dispatcher domain in
`@objectstack/runtime` that is the designed primary surface for cloud's
per-environment kernels (`registerShareLinkRoutes: false`). Fixing one would
have moved the oracle to whichever embedding uses the other.

**Nothing else moves.** With the block ON, every refusal is exactly what it was:
`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED` and `EXPIRED_OR_REVOKED`
are unchanged in status, code and message, and a correct password or a signed-in
viewer still resolves the record. Mint-time behaviour is untouched, no
`sys_share_link` row is written or read differently, and no error code is added
or retired.

**Consumer impact.** A viewer that branches on the refusal STATUS sees TWO
changes, for links on a switched-off object only — and the measured consumer
branches on status alone. On the objectui console at `67dadd6`,
`apps/console/src/pages/SharedRecordPage.tsx` lines 70-85 dispatch on
`res.status` and never on the body's error code, so:

- all three 401 arms (`NEEDS_PASSWORD`, `WRONG_PASSWORD`, `SIGN_IN_REQUIRED`)
 rendered the password prompt and now render the 404 copy, "This link is
 invalid or no longer available.";
- the 410 arm rendered "This link has expired or was revoked." and now renders
 that same 404 copy.

Both shifts are the intended outcome and were accepted with the ruling: a
correct password on such a link yields nothing, so prompting for one teaches the
holder to open a door that is bricked up, and "expired or revoked" is a claim
about a token whose existence the caller must not be able to confirm. Links on
objects whose block is on are unaffected — prompt, 410 copy and 200 render
included.

Maintainer ruling 2026-09-03 (decision batch #17, item 1), verbatim 「同意」,
adopting option A over option B (keep the 401 and document the accepted oracle)
and option C (gate only the two 401 arms, rejected as proliferation).

<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, type, default and accept-set, and this change is only WHICH HTTP STATUS the route layer answers with while that switch is off. There is no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform on any consumer — a deployment that wants the 401 affordance back enables the object's block, which is an authoring decision, not a migration. -->

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -135,7 +135,7 @@ The largest single consumer — **17 of the 106 sites**.
| 34 | `revoke()` deletes directly, **before** the non-manual-source guard | Get: the evaluator can revoke its own grants. Lose: the `CONFLICT` guard that warns a rule-materialised grant will be silently re-granted on the next reconcile | `plugin-sharing/src/sharing-service.ts:1476` (guard at `:1501`) |
| 35 | `listShares()` skips the management gate | Get: full enumeration of who can see a record | `plugin-sharing/src/sharing-service.ts:1528` |
| 36 | `sys_record_share` reads are **not** self-scoped | Get: tenant-wide share listing without `manage_sharing` | `sharing-plugin.ts:1088` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:449`, `:503`, `:507`, `:580`, `:610` |
| 37 | Share-link policy `enabled` check bypassed; system callers re-enter under a system context | Get: link **creation** while the policy is off — resolution is **not** bypassed since #14033 (`publicSharing.enabled` is a standing policy held at every redemption): a link minted this way does not resolve until the block is enabled | `plugin-sharing/src/share-link-service.ts:469`, `:523`, `:527`, `:600`, `:630` |
| 38 | Sharing-rule provenance stamp skipped | Lose: the row is not marked as an admin customization — seeder / `defineRule` / boot reconcilers are "the package door" | `sharing-rule-provenance.ts:47` |
| 39 | Sharing-rule service write + delete paths return early | Lose: the manage-rules gate on the service surface, and the platform-global-rule delete guard | `sharing-rule-service.ts:165`, `:390` |

Expand Down
Loading
Loading