plugin-sharing's SINGLE-record write gates still read the phantom `owner_id` on federated objects (the three `hasOwnerField` consumers #7858 did not touch)

[os-zhuang]

Found while implementing #7858. Filed unassigned, and deliberately not fixed in that PR: #7858's scope was ruled to be the two bulk filters, and the paths below fail closed, so widening them is a security-relevant change that deserves its own analysis rather than a rider.

What #7858 fixed, and what it did not

hasOwnerField (packages/plugins/plugin-sharing/src/sharing-service.ts:141) has five consumers. #7858 guarded two of them — buildReadFilter and buildWriteFilter — with a provenance test: an owner_id byte-identical to the shipped OWNER_FIELD_DEF on an external object is the registry's injected anchor, not a real column, so ownership scoping contributes nothing.

The other three still gate on the raw field-existence answer:

• checkEdit (:549 pre-PR numbering)
• checkDelete (:631)
• assertSharingEnabled (:872)

The code path

checkEdit / checkDelete both reach the shared ownership fast-path matchesOwnerScope, which selects the phantom column straight off the remote table:

const own = await this.engine.find(object, {
  where: { id: recordId },
  fields: ['id', OWNER_FIELD],   // OWNER_FIELD = 'owner_id'
  limit: 1,
  context: SYSTEM_CTX,
});
const owner = Array.isArray(own) && own[0] ? (own[0] as any)[OWNER_FIELD] : undefined;
if (owner == null) return false;

On a federated object the platform provisions no storage (Engine.syncObjectSchema returns early for external != null), so owner_id is not in the remote table. The ownership fast-path can therefore never admit: either the driver raises and the try/catch routes to writeGateFailClosed, or the value comes back absent and matchesOwnerScope returns false. Both land on deny once the share-grant and modifyAllRecords branches also miss.

assertSharingEnabled is the mirror image: it currently reports a phantom-anchor federated object as share-able (hasOwnerField is true), so a share row can be minted on an object whose gates can never consult it.

Why this is filed rather than fixed

The direction is opposite to #7858's. There, the phantom predicate made a readable object unreadable; here the same phantom column makes the gates refuse, which is fail-closed and safe. Flipping checkEdit / checkDelete to abstain would hand the decision to other layers and could turn a refusal into an allow — that needs deciding, not guessing. assertSharingEnabled's answer is a separate question again (refusing to mint a useless share row is arguably the improvement).

Not measured

⚠️ This is a code-path reading, not a boot measurement — unlike #7858's body, which carried real filter output from a booted stack. I did not run a federated single-record write. The dialect behaviour of selecting a nonexistent column in the SELECT list (as opposed to #7858's comparison-position degradation on SQLite) is specifically unverified. Worth measuring before acting.

Related

• plugin-sharing lowers __readScope own/unit to an owner_id predicate on federated objects, where owner_id is a phantom column #7858 — the two bulk filters, fixed.
• plugin-security injects org- and owner-shaped predicates onto federated external objects too — the #7738 defect on a layer outside objectql #7835 — the tenant half, on the plugin-security layer.
• external-datasource-federated-read: the platform injects its org-scoping predicate onto a federated remote table that has no organization_id column #7738 / PR fix(objectql): withhold the org-scope predicate from federated objects (#7738) #7833 — the engine half.
• [Decision] applySystemFields injects platform anchors into external objects the platform provisions no storage for — three consumers have now independently re-derived "that column is not really there" #7865 — the registry-level producer decision (direction B: keep injecting, add a provenance marker). If that marker lands, all of these converge on reading it.

---

Generated by Claude Code

[hotlong]

Triage: lands in domain:identity (packages/plugins/plugin-sharing); graded finding (held), not queued.

Rationale: today's behaviour is fail-closed and therefore safe; the body is a code-path reading with the single-record write path explicitly unmeasured; and the correct end-state converges on #7865's provenance marker (direction B, in flight in domain:engine-core). Widening checkEdit / checkDelete from refuse to abstain is a security-relevant relaxation that must not be guessed — if measurement later shows real users blocked on federated single-record writes, that evidence re-grades this card.

Re-grade trigger for the finding-triage round: when #7865's marker lands on origin/main, this card's fix becomes "read the marker in the three remaining hasOwnerField consumers" and it should be promoted to pm:queue (same lane, likely same shape as #7858's guard). The assertSharingEnabled half (refusing to mint a share row the gates can never consult) can ride the same PR.

Type: Bug.

---

Generated by Claude Code

[hotlong]

Triage (findings round): promoted finding → pm:queue, stays domain:identity, type Bug — with a two-phase scope ruling:

• Phase 1 (in scope): measure. Run a real federated single-record write through checkEdit / checkDelete — the card itself flags that the SELECT-list behaviour for a nonexistent column is specifically unverified and dialect-dependent. The deliverable is the measured refusal (or the surprise), same discipline as plugin-sharing lowers __readScope own/unit to an owner_id predicate on federated objects, where owner_id is a phantom column #7858's booted-stack evidence.
• Phase 2 (in scope, only if Phase 1 confirms): assertSharingEnabled only. Refusing to mint a share row that the gates can never consult is the fail-closed direction — safe to take.
• ⛔ Out of scope: flipping checkEdit / checkDelete to abstain. That can turn a refusal into an allow; per the card's own analysis it needs a decision, not a dispatch. If Phase 1 confirms the dead-end, report it with measurements and the options — that report is the input to a decision card, not a license to widen.

Re-grade note stands from the earlier hold: if #7865's provenance marker lands first, all five hasOwnerField consumers converge on reading it, and this card's Phase 2 should be re-checked against that shape before dispatch (stale-premise check at claim time).

Size/model suggestion: M, opus (security-adjacent judgment on the gates).

---

Generated by Claude Code