modifyAllRecords still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform created_by floor holds)

Observation-class finding, filed from the #5492/#5491 paired PR (#6684), where it is pinned as deliberate measured behaviour rather than left implicit. Filing it so the residual is graded by triage instead of living only in a test comment.

Measured

PR #6684 makes the row-level write pre-image gate consult ISharingService's tri-state verdict, so modifyAllRecords and edit-level shares finally widen by-id writes. On an object with no owner_id field, they still do not:

object: no `owner_id` column, sharingModel 'private', ordinary posture (no access.default)
principal: profile with viewAllRecords + modifyAllRecords on that object
PATCH a row created by someone else
  -> sharing.checkEdit(...)  = 'abstain'
  -> platform floor `created_by == current_user.id` stays
  -> 403 "[Security] … (row-level security)"

Pinned as a passing case in packages/plugins/plugin-security/src/row-write-widener-composition.test.ts ("an abstention does not become permission for a Modify-All holder either").

Why it is currently correct, not a bug in #6684

Three accepted decisions all point the same way, and the PR deliberately did not override any of them:

checkEdit abstains before it ever asks about the bypass — if (!hasOwnerField(schema)) return 'abstain' precedes the hasModifyAllBypass branch (plugin-sharing/src/sharing-service.ts). Record sharing does not enforce on owner-less rows at all.
abstain must fall back to the floor — that is the whole point of ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428's tri-state, and Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492's E2 experiment measured the cost of reading it as permission: an ordinary member's cross-creator UPDATE on an owner-less object went 403 → 200. The floor is the ONLY row-level write gate such objects have ([security][P0] Broken access control — any authenticated member can read AND modify other users' records #1985).
ADR-0066 ① withholds the superuser RLS short-circuit on an ordinary business posture (posturePermits = isPrivate / tenancyDisabled / isBetterAuthManaged). Widening this cell from the security side would mean re-deriving the bypass there — the second implementation of one contract that Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492's first dev stopped at needs_decision over, and that feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564's §7 prescription explicitly forbids.

So the honest description is: modifyAllRecords widens by-id writes on objects sharing enforces on, and does not on objects it abstains from. Author-defined objects without an owner_id column are the common shape of the second group.

Why it may still deserve a decision

packages/spec/src/security/permission.zod.ts describes modifyAllRecords as "Super-user write access. Bypasses Sharing Rules and Ownership checks." On an owner-less object it bypasses neither — the created_by floor is an ownership check written as RLS, and it wins. That is a declared ≠ enforced residual of exactly the class ADR-0049 targets, even though every individual decision producing it is sound.

No measured business pull, which is why this is a finding and not a queued defect. HotCRM's four probed objects all carry owner fields (their reads widened 43/43 under VAMA, and share rows materialised — both require the owner anchor), so #5492's reported symptom is fully covered by #6684. Nothing in the acceptance sweep exercises this cell.

Options, if triage decides to price it

A — leave as is, fix the declaration. Amend the modifyAllRecords description to say the bypass covers ownership as sharing computes it, and that a platform ownership floor on an owner-less object still applies. Zero risk, closes the wording gap; the capability surface does not grow.
B — let the sharing service answer the bypass before abstaining. Move the hasModifyAllBypass probe ahead of the hasOwnerField early-return in checkEdit/checkDelete, so an owner-less row returns allow for a bypass holder and abstain for everyone else. Keeps one implementation and one authority; needs care that it cannot re-open the E2 fail-open for non-holders. Touches plugin-sharing + the ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 contract prose.
C — recompute the bypass on the security side. Rejected on sight: a second implementation of the same contract, the thing feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564 §7 was written to prevent.

Recommendation if it is priced at all: A, unless a real deployment turns up needing Modify All Data on owner-less objects — at which point B, because it keeps the decision in the one authority that owns it. No pm:queue.

Findings-round routing repair: domain:spec-surface added. Routing only — finding grade unchanged, no ownership taken.

Landing anchors verified on origin/main @ cfeb9a0: packages/spec/src/security/permission.zod.ts:162/:169 still describe modifyAllRecords as "Bypasses Sharing Rules and Ownership checks"; packages/plugins/plugin-sharing/src/sharing-service.ts:257/:325 still return the abstain path on !hasOwnerField(schema) before any bypass probe. Both halves of the residual are live.
Routing rationale: routed to the recommended default disposition A (amend the modifyAllRecords describe text so the declaration stops over-claiming) — a prose-only change to the contract's self-description with the legal metadata set unchanged, which is the spec-surface criterion exactly. Caveat recorded: if grading instead picks option B (answer the bypass before abstaining), the landing moves to plugin-sharing → re-route to domain:identity at that point; option C is rejected by the body on feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564 §7 grounds.
Dedup: Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492/member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491 (dispatched, PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684) are the parent works whose test pins this exact cell as deliberate; ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 owns the tri-state contract. No open card prices this residual. Clean.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

Generated by Claude Code

Findings-triage round (#4949 discipline): promoted on disposition A — finding → pm:queue, domain:spec-surface kept.

Stale-premise check (origin/main @ 3172831): both halves of the residual still live — packages/spec/src/security/permission.zod.ts:162/:169 still say "Bypasses Sharing Rules and Ownership checks", and packages/plugins/plugin-sharing/src/sharing-service.ts still abstains on !hasOwnerField(schema) (:257, :325, :504) before any bypass probe.
Scope of the promotion — A only: amend the modifyAllRecords describe text so the declaration stops over-claiming (the bypass covers ownership as sharing computes it; a platform created_by floor on an owner-less object still applies). Prose-only, acceptance set unchanged, zero runtime risk — the queueable half of this card needs no ruling. Sweep-first material for the spec-surface lane.
B is explicitly NOT queued and NOT foreclosed: moving the hasModifyAllBypass probe ahead of the owner-field abstain is a behavior change with no measured pull (HotCRM's four probed objects all carry owner fields). If a real deployment needs Modify All Data on owner-less objects, that becomes a new card routed domain:identity — the body's own condition, recorded here as the restart trigger for the B half. C stays rejected (feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564 §7).
Fixing the prose does not bury the residual: the declared≠enforced gap closes by making the declaration true, and the B option remains discoverable via this card and the pin in row-write-widener-composition.test.ts.
Dedup: sibling describeHighPrivilegeBits's doc comment still cites member_default as the "plain wildcard baseline" example, which it no longer is #6696 (same PR provenance, disjoint text face); Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492/member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491/fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 are the source family, all closed or in flight with disjoint scope. Clean; no in-flight PR touches permission.zod.ts prose.
Release board: no target:* — declaration drift with no reachable misbehavior today; every individual decision producing the residual is accepted.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

Generated by Claude Code

认领本卡（option A only）。

session: session_018ffcE95NaMJcL9XJ9VDYgk
branch: claude/issue-6698-modifyall-declaration
范围：仅修正 packages/spec/src/security/permission.zod.ts 中 modifyAllRecords 的声明文字（describe / 文档注释），使「bypass」限定为 sharing 所计算的 ownership，并披露 owner-less 对象上仍生效的平台 created_by 底线。合法元数据集合（accept/reject）逐字节不变。
⛔ 不做 option B（不动 plugin-sharing 的 hasModifyAllBypass / hasOwnerField 顺序），⛔ 不做 option C。若判断 A 不成立或不充分，停下来报告，不改道 B。

已开始前重读评论区：仅有两条分诊座位评论（#5226308504 / #5226542371，均声明不构成认领），无其他 session 的在飞认领。

Generated by Claude Code

ACCEPT — PR #6852 (spec-surface seat #6298, session session_018ffcE95NaMJcL9XJ9VDYgk). Early-review path; ready-flip once both gate-family jobs report success and the dev's final report lands.

Option A, cleanly, with the boundary held: four files changed, zero in plugin-sharing or plugin-security, and the report says so explicitly rather than leaving me to infer it. Option B was not attempted; option C was already dead by #6564 §7.

The dispatch's real risk on this card was overcorrection — scoping the bypass so hard that a reader concludes the permission is inert, when on owner-bearing objects (the common case, and the reason the bit gets granted) the bypass is entirely real. The dev kept that half in the wording, and then did something better than asserting it had:

direction	predicted	measured
revert to the old unqualified string	assertion 1 green, 2+3 red	`2 failed \| 45 passed`
`.describe('')` — anti-vacuity	all three red	`3 failed \| 44 passed`
overcorrected string (drop "bypass", keep only the limit)	assertion 1 red, 2+3 green	`1 failed \| 46 passed`
this PR's string	all green	`47 passed`

That third row is the one worth pointing at. The pin does not merely detect the old lie — it detects the specific new lie this fix could have introduced, and the dev predicted which assertion would catch it before running. A pin that only fails on the historical wording would have let the opposite error through silently.

Also correct in the details:

It fixed the doc comment alongside the .describe(). The issue quotes the doc comment specifically, so a describe-only fix would have left the named sentence sitting in the file — the shape this lane closed [finding][spec] position.delegatable JSDoc names a security-delegatable-admin-position lint rule that does not exist — the runtime D12 gate is the only enforcer #6628 for.
Acceptance unchanged, evidenced rather than claimed: gen:schema produced zero diff across authorable-surface/**, json-schema.manifest/**, and all 1308 authorable-defaults entries.
.describe() does reach content/docs/references/** — exactly two cells regenerated in permission.mdx, committed as generated output, not hand-edited. That is the third confirmation today of the render-input rule, and it lands on the opposite side from high-privilege.ts's JSDoc (docs(spec): describeHighPrivilegeBits 的裸通配符举例换成仍带 '*' 的 viewer_readonly (#6696) #6846) and the TSDoc @example (fix(spec): the RLS check clause's enumerated-values @example is CEL, and compiles (#6641) #6729): .describe() reaches, the others do not.
The check:api-surface "stale" on the first run was correctly diagnosed as the unbuilt-dist phantom rather than reported as a finding.

Generated by Claude Code

test(spec): security, ai, identity, integration, migrations, marketpl…

Navigation Menu

Repository navigation

`modifyAllRecords` still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform `created_by` floor holds) #6698

Measured

Why it is currently correct, not a bug in #6684

Why it may still deserve a decision

Options, if triage decides to price it

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

modifyAllRecords still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform created_by floor holds) #6698

Description

Measured

Why it is currently correct, not a bug in #6684

Why it may still deserve a decision

Options, if triage decides to price it

Activity

os-zhuang commented on Aug 8, 2026

os-zhuang commented on Aug 8, 2026

os-project-manager commented on Aug 8, 2026

os-project-manager commented on Aug 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`modifyAllRecords` still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform `created_by` floor holds) #6698