feat(sharing): a record's share-manager may revoke any share-link on that record (ADR-0111 D8, framework)

[os-zhuang]

What this is

The framework half of ADR-0111 D8 (share-link re-share semantics), the first of the two ADR-0111 follow-ups. Follows P0 (#3965) and P1 (#3975), both merged.

The two D8 rulings

• Mint authority = publicSharing opt-in AND record visibility. Already enforced by createLink (the SHARING_NOT_ENABLED policy check + the caller-context visibility read); this PR states it as the deliberate decision it always was — an opted-in object delegates re-share power to anyone who can see the record. No behaviour change, one clarifying comment.
• A record's share-manager may revoke any link on that record. The real change. ShareLinkService.revokeLink was creator-or-system only, so a record's owner / modifyAllRecords admin could not kill a link someone else minted on their record. Revoke authority now also admits a record share-manager, probed via the sharing service's late-bound canManageShares (the same authority predicate P0 introduced).

How it's wired

• ShareLinkServiceOptions.canManageShares? — an optional late-bound probe. The plugin passes this.service.canManageShares (the SharingService instance, always constructed — even under enforce: false, cloud's share-link-only config).
• revokeLink fetches object_name / record_id and, when the caller is neither creator nor system, consults the probe. Fails closed: no probe, or a throwing probe, keeps the pre-D8 creator-only behaviour — a deployment without the sharing service degrades safely rather than opening revoke up.

Testing

• New share-link-service.test.ts cases: a record manager revokes a link another user minted (probe consulted with the link's own (object, record)); a bystander is denied; no probe → creator-only; throwing probe → fail-closed deny. Existing Finding-2 authz tests unchanged.
• Full plugin-sharing suite green: 193 tests. Changed files lint clean; package builds.

Docs

protocol/objectql/security share-link section now states the mint + revoke authority. ADR-0111 status updated. (The v14 release note describing the original creator-only revoke is left intact — it accurately records what v14 shipped.)

Not in this PR — the cloud half

The user-facing share-link surface at scale is cloud's HttpDispatcher.handleShareLinks (per-environment shareLinks service). That wiring + the .objectstack-sha bump to pick up this change land as a follow-up in objectstack-ai/cloud once this merges. The DEPTH management extension (D1 D-future) remains the other open ADR-0111 follow-up.

🤖 Generated with Claude Code

https://claude.ai/code/session_012P3RFCpjjiSQ7WuamSDW7W

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 30, 2026 12:59am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-sharing.

4 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/permissions/authorization.mdx(via packages/plugins/plugin-sharing)
• content/docs/permissions/permissions-matrix.mdx(via packages/plugins/plugin-sharing)
• content/docs/plugins/packages.mdx(via @objectstack/plugin-sharing)
• content/docs/protocol/objectql/security.mdx(via packages/plugins/plugin-sharing)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.