`modifyAllRecords` still does not widen a by-id write on an object with NO owner field (sharing abstains, the platform `created_by` floor holds)

[os-zhuang]

Observation-class finding, filed from the #5492/#5491 paired PR (#6684), where it is pinned as deliberate measured behaviour rather than left implicit. Filing it so the residual is graded by triage instead of living only in a test comment.

Measured

PR #6684 makes the row-level write pre-image gate consult ISharingService's tri-state verdict, so modifyAllRecords and edit-level shares finally widen by-id writes. On an object with no owner_id field, they still do not:

object: no `owner_id` column, sharingModel 'private', ordinary posture (no access.default)
principal: profile with viewAllRecords + modifyAllRecords on that object
PATCH a row created by someone else
  -> sharing.checkEdit(...)  = 'abstain'
  -> platform floor `created_by == current_user.id` stays
  -> 403 "[Security] … (row-level security)"

Pinned as a passing case in packages/plugins/plugin-security/src/row-write-widener-composition.test.ts ("an abstention does not become permission for a Modify-All holder either").

Why it is currently correct, not a bug in #6684

Three accepted decisions all point the same way, and the PR deliberately did not override any of them:

1. checkEdit abstains before it ever asks about the bypass — if (!hasOwnerField(schema)) return 'abstain' precedes the hasModifyAllBypass branch (plugin-sharing/src/sharing-service.ts). Record sharing does not enforce on owner-less rows at all.
2. abstain must fall back to the floor — that is the whole point of ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428's tri-state, and Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492's E2 experiment measured the cost of reading it as permission: an ordinary member's cross-creator UPDATE on an owner-less object went 403 → 200. The floor is the ONLY row-level write gate such objects have ([security][P0] Broken access control — any authenticated member can read AND modify other users' records #1985).
3. ADR-0066 ① withholds the superuser RLS short-circuit on an ordinary business posture (posturePermits = isPrivate / tenancyDisabled / isBetterAuthManaged). Widening this cell from the security side would mean re-deriving the bypass there — the second implementation of one contract that Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492's first dev stopped at needs_decision over, and that feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564's §7 prescription explicitly forbids.

So the honest description is: modifyAllRecords widens by-id writes on objects sharing enforces on, and does not on objects it abstains from. Author-defined objects without an owner_id column are the common shape of the second group.

Why it may still deserve a decision

packages/spec/src/security/permission.zod.ts describes modifyAllRecords as "Super-user write access. Bypasses Sharing Rules and Ownership checks." On an owner-less object it bypasses neither — the created_by floor is an ownership check written as RLS, and it wins. That is a declared ≠ enforced residual of exactly the class ADR-0049 targets, even though every individual decision producing it is sound.

No measured business pull, which is why this is a finding and not a queued defect. HotCRM's four probed objects all carry owner fields (their reads widened 43/43 under VAMA, and share rows materialised — both require the owner anchor), so #5492's reported symptom is fully covered by #6684. Nothing in the acceptance sweep exercises this cell.

Options, if triage decides to price it

• A — leave as is, fix the declaration. Amend the modifyAllRecords description to say the bypass covers ownership as sharing computes it, and that a platform ownership floor on an owner-less object still applies. Zero risk, closes the wording gap; the capability surface does not grow.
• B — let the sharing service answer the bypass before abstaining. Move the hasModifyAllBypass probe ahead of the hasOwnerField early-return in checkEdit/checkDelete, so an owner-less row returns allow for a bypass holder and abstain for everyone else. Keeps one implementation and one authority; needs care that it cannot re-open the E2 fail-open for non-holders. Touches plugin-sharing + the ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 contract prose.
• C — recompute the bypass on the security side. Rejected on sight: a second implementation of the same contract, the thing feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564 §7 was written to prevent.

Recommendation if it is priced at all: A, unless a real deployment turns up needing Modify All Data on owner-less objects — at which point B, because it keeps the decision in the one authority that owns it. No pm:queue.

[os-zhuang]

Findings-round routing repair: domain:spec-surface added. Routing only — finding grade unchanged, no ownership taken.

• Landing anchors verified on origin/main @ cfeb9a0: packages/spec/src/security/permission.zod.ts:162/:169 still describe modifyAllRecords as "Bypasses Sharing Rules and Ownership checks"; packages/plugins/plugin-sharing/src/sharing-service.ts:257/:325 still return the abstain path on !hasOwnerField(schema) before any bypass probe. Both halves of the residual are live.
• Routing rationale: routed to the recommended default disposition A (amend the modifyAllRecords describe text so the declaration stops over-claiming) — a prose-only change to the contract's self-description with the legal metadata set unchanged, which is the spec-surface criterion exactly. Caveat recorded: if grading instead picks option B (answer the bypass before abstaining), the landing moves to plugin-sharing → re-route to domain:identity at that point; option C is rejected by the body on feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564 §7 grounds.
• Dedup: Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492/member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491 (dispatched, PR fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684) are the parent works whose test pins this exact cell as deliberate; ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 owns the tri-state contract. No open card prices this residual. Clean.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings-triage round (#4949 discipline): promoted on disposition A — finding → pm:queue, domain:spec-surface kept.

• Stale-premise check (origin/main @ 3172831): both halves of the residual still live — packages/spec/src/security/permission.zod.ts:162/:169 still say "Bypasses Sharing Rules and Ownership checks", and packages/plugins/plugin-sharing/src/sharing-service.ts still abstains on !hasOwnerField(schema) (:257, :325, :504) before any bypass probe.
• Scope of the promotion — A only: amend the modifyAllRecords describe text so the declaration stops over-claiming (the bypass covers ownership as sharing computes it; a platform created_by floor on an owner-less object still applies). Prose-only, acceptance set unchanged, zero runtime risk — the queueable half of this card needs no ruling. Sweep-first material for the spec-surface lane.
• B is explicitly NOT queued and NOT foreclosed: moving the hasModifyAllBypass probe ahead of the owner-field abstain is a behavior change with no measured pull (HotCRM's four probed objects all carry owner fields). If a real deployment needs Modify All Data on owner-less objects, that becomes a new card routed domain:identity — the body's own condition, recorded here as the restart trigger for the B half. C stays rejected (feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564 §7).
• Fixing the prose does not bury the residual: the declared≠enforced gap closes by making the declaration true, and the B option remains discoverable via this card and the pin in row-write-widener-composition.test.ts.
• Dedup: sibling describeHighPrivilegeBits's doc comment still cites member_default as the "plain wildcard baseline" example, which it no longer is #6696 (same PR provenance, disjoint text face); Row-level write gate consults neither modifyAllRecords nor sys_record_share.access_level — both declared write-widening mechanisms are inert #5492/member_default's * wildcard object grant (C/R/E) union-merges into every org member — app-side explicit-allow object gates are erased on three axes #5491/fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 are the source family, all closed or in flight with disjoint scope. Clean; no in-flight PR touches permission.zod.ts prose.
• Release board: no target:* — declaration drift with no reachable misbehavior today; every individual decision producing the residual is accepted.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code