Skip to content

fix(runtime): dispatcher 面 /share-links 整体透传 ExecutionContext 给 enforcement (#6551)#6647

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-project-manager merged 3 commits into from
Aug 8, 2026
Merged

fix(runtime): dispatcher 面 /share-links 整体透传 ExecutionContext 给 enforcement (#6551) #6647

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2a9d14d
fix(runtime): dispatcher /share-links passes the whole ExecutionConte…
claude Aug 8, 2026
0431635
changeset: runtime patch — dispatcher share-links full envelope (#6551)
claude Aug 8, 2026
5416470
test(runtime): manifest service in SecurityPlugin boot harness (#6551)
claude Aug 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/share-links-dispatcher-full-envelope.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
"@objectstack/runtime": patch
---

Dispatcher-face `/share-links` enforcement now receives the caller's complete resolved `ExecutionContext` (#6551 — the dispatcher half of #6206). The domain handler used to rebuild a two-field `{ userId, tenantId }` subset and hand it to `createLink` / `listLinks` / `revokeLink`, dropping `accessible_org_ids`, `positions`, `permissions`, `org_user_ids`, `systemPermissions`, `posture` and `tabPermissions` on the way into enforcement. Under the `group` tenancy posture the Layer 0 wall reads `accessible_org_ids` and an absent set denies (fail closed), so creating a link answered 403 for records the caller reads fine elsewhere; a record visible only through a position-bound permission set was likewise refused even under the `single` posture. The envelope is now passed through whole per the #6511 contract; the routes' own 401 gate still reads only `userId`.
1 change: 1 addition & 0 deletions packages/runtime/package.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -47,6 +47,7 @@
"devDependencies": {
"@objectstack/platform-objects": "workspace:*",
"@objectstack/plugin-hono-server": "workspace:*",
"@objectstack/plugin-sharing": "workspace:*",
"@objectstack/service-analytics": "workspace:*",
"@objectstack/service-datasource": "workspace:*",
"@objectstack/service-job": "workspace:*",
Expand Down
Loading
Loading