Uh oh!
There was an error while loading. Please reload this page.
fix(sharing)!: an edit-level share no longer grants delete (ADR-0111 D3, the verb boundary) - #3975
Merged
Merged
Conversation
…D3, the verb boundary) update and delete shared one canEdit gate, and canEdit accepts an edit-level share — so one "edit" grant silently conferred delete (the opposite error from the retired `full` level, which promised delete and gave nothing). A share widens which rows a principal reaches, never which verbs they may use. - ISharingService.canDelete: ownership (widened by write DEPTH) or the modifyAllRecords bypass ONLY; an edit/full share does not confer it. canEdit is unchanged (the update gate). - SharingService.buildWriteFilter takes a verb param: a bulk delete scopes to owned rows alone (no share widening), a bulk update keeps it. - The sharing middleware routes delete through canDelete and logs a specific fail-closed reason on denial (D10). - /security/explain consults canDelete for a delete operation, so the record-level explanation matches enforcement. Breaking: a caller who could delete only through an edit share can no longer delete — delete requires ownership, write depth, or Modify All. No new delete level is introduced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012P3RFCpjjiSQ7WuamSDW7W
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 3 package(s): 108 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
July 30, 2026 00:44
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
The P1 implementation of ADR-0111 — D3, the verb boundary — fixing #3902's second finding. Follows the P0 authorization face (#3965, merged).
updateanddeleteshared onecanEditgate, andcanEditaccepts anedit-level share — so one "edit" grant silently conferred delete (the mirror of the retiredfulllevel, which promised delete and gave nothing: here we gave more than we said). Every comparable platform keeps these distinct: Salesforce Read/Write cannot delete; DataverseDeleteis an independent privilege; Odoo splitswrite/unlink.The change
ISharingService.canDelete(object, recordId, context)— ownership (widened by write DEPTH) or themodifyAllRecordssuper-user bypass (which reaches the gate as__writeScope === 'org') only. Aneditor legacyfullshare does not confer it.canEditis unchanged (the update gate, share included). The shared ownership/DEPTH fast-path is extracted into onematchesOwnerScopehelper so the two gates cannot drift.SharingService.buildWriteFilter(object, context, verb)— a bulkdelete({multi:true})scopes to the owner/DEPTH set alone (no share OR-branch); a bulkupdatekeeps the edit-share widening.deletethroughcanDelete/buildWriteFilter(…, 'delete'), and logs a specific fail-closed reason on a delete denial (ADR-0111 D10 — the tightening is greppable, not a mystery 403)./security/explainconsultscanDeletefor adeleteoperation (newcanDeleteRecordbinding), so the record-level explanation matches enforcement by construction.No new delete access level. Consistent with
access-level.ts's stated principle and #3865's direction — a share widens rows, never verbs. A future per-record delete grant would be a capability mask AND-ed with object CRUD (the Dataverse shape), not a fourthaccess_level.Breaking
A caller who could delete a record only through an edit-level share (and holds object-level delete CRUD) can no longer delete it — delete now requires ownership, write depth, or Modify All Data. Migration is direct/fail-closed per ADR-0111 D10: deny-log +
/security/explain+ this changeset's breaking entry, no warn-only window, no escape valve.Testing
canDeleteunit matrix: system/public/owner-less allow (matchescanEdit); owner yes; non-owner no; edit share →canEdittrue butcanDeletefalse; legacyfullshare likewise; Modify All (__writeScope=org) yes; principal-less no.skill-docs/spec-changes/upgrade-guide/authorable-surface/api-surface) all pass; changed files lint clean.Docs
services.sharingruntime-service page (newcanDelete+ verb-boundary section), kernel services index,protocol/objectql/securitysharing-level note (now precise: thecanDeletegate is distinct fromcanEdit).Remaining ADR-0111 scope
D8 (share-link re-share rulings) and the DEPTH management extension (D1 D-future) — separate follow-up PRs per the ADR's rollout.
🤖 Generated with Claude Code
https://claude.ai/code/session_012P3RFCpjjiSQ7WuamSDW7W
Generated by Claude Code