feat(storage): parent-derived attachment access + upload auth; drop dead share_type/visibility (#2755)

Part 2 of #2755 (enforce-or-remove, ADR-0049). sys_attachment rows ride
the generic data path where the default member sets grant wildcard CRUD —
any member could attach files to records they cannot see and delete other
users' attachments; uploaded_by was client-spoofable; the storage upload
routes were fully anonymous.

- service-storage attachment access hooks (Salesforce parent-derived
  semantics): beforeInsert requires caller READ visibility of the parent
  record (403 ATTACHMENT_PARENT_ACCESS, caller-scoped findOne so RLS/OWD/
  sharing apply) and server-stamps uploaded_by from the session;
  beforeDelete requires uploader-or-parent-editor (sharing.canEdit; 403
  ATTACHMENT_DELETE_DENIED; multi-deletes need every row to pass; read-
  visibility fallback when no sharing service). System context bypasses.
- storage routes: optional resolveSession gate — with an auth service
  wired, the six upload entry points 401 anonymous callers (fail-closed
  on resolver errors) and new sys_file rows are stamped with owner_id;
  without one (bare kernels/tests) routes stay open. Download capability
  URLs stay anonymous (tracked follow-up).
- sys_attachment: share_type/visibility removed — modeled in v1 with zero
  runtime consumers (ADR-0049 state 3); translation bundles regenerated.
- rest: mapDataError branches for the two new 403 codes (#2707 lesson).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0187NT3Qer9oep5dCRb9b8Lt

Author: claude

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -473,7 +473,11 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
     },
     _views: {
       mine: {
-        label: "My Memberships"
+        label: "My Memberships",
+        emptyState: {
+          title: "No organizations yet",
+          message: "You haven't joined any organizations."
+        }
       }
     },
     _actions: {
@@ -1354,7 +1358,11 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
     },
     _views: {
       recent: {
-        label: "Recent"
+        label: "Recent",
+        emptyState: {
+          title: "No events",
+          message: "No notification events have been emitted."
+        }
       },
       by_topic: {
         label: "By Topic"
@@ -1391,23 +1399,6 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       size: {
         label: "Size (bytes)"
       },
-      share_type: {
-        label: "Share Type",
-        help: "viewer | collaborator | inferred (inherited from parent record)",
-        options: {
-          viewer: "viewer",
-          collaborator: "collaborator",
-          inferred: "inferred"
-        }
-      },
-      visibility: {
-        label: "Visibility",
-        options: {
-          internal: "internal",
-          all_users: "all_users",
-          shared_users: "shared_users"
-        }
-      },
       uploaded_by: {
         label: "Uploaded By"
       },

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -473,7 +473,11 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
     },
     _views: {
       mine: {
-        label: "My Memberships"
+        label: "My Memberships",
+        emptyState: {
+          title: "No organizations yet",
+          message: "You haven't joined any organizations."
+        }
       }
     },
     _actions: {
@@ -1354,7 +1358,11 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
     },
     _views: {
       recent: {
-        label: "Recent"
+        label: "Recent",
+        emptyState: {
+          title: "No events",
+          message: "No notification events have been emitted."
+        }
       },
       by_topic: {
         label: "By Topic"
@@ -1391,23 +1399,6 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       size: {
         label: "Tamaño (bytes)"
       },
-      share_type: {
-        label: "Tipo de compartición",
-        help: "visualizador | colaborador | inferido (heredado del registro principal)",
-        options: {
-          viewer: "Visualizador",
-          collaborator: "Colaborador",
-          inferred: "Inferido"
-        }
-      },
-      visibility: {
-        label: "Visibilidad",
-        options: {
-          internal: "Interno",
-          all_users: "Todos los usuarios",
-          shared_users: "Usuarios compartidos"
-        }
-      },
       uploaded_by: {
         label: "Subido por"
       },

packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts

@@ -473,7 +473,11 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
     },
     _views: {
       mine: {
-        label: "My Memberships"
+        label: "My Memberships",
+        emptyState: {
+          title: "No organizations yet",
+          message: "You haven't joined any organizations."
+        }
       }
     },
     _actions: {
@@ -1354,7 +1358,11 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
     },
     _views: {
       recent: {
-        label: "Recent"
+        label: "Recent",
+        emptyState: {
+          title: "No events",
+          message: "No notification events have been emitted."
+        }
       },
       by_topic: {
         label: "By Topic"
@@ -1391,23 +1399,6 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       size: {
         label: "サイズ（バイト）"
       },
-      share_type: {
-        label: "共有タイプ",
-        help: "viewer | collaborator | inferred（親レコードから継承）",
-        options: {
-          viewer: "閲覧者",
-          collaborator: "共同編集者",
-          inferred: "推定"
-        }
-      },
-      visibility: {
-        label: "公開範囲",
-        options: {
-          internal: "内部",
-          all_users: "すべてのユーザー",
-          shared_users: "共有ユーザー"
-        }
-      },
       uploaded_by: {
         label: "アップロード者"
       },

packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts

@@ -473,7 +473,11 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
     },
     _views: {
       mine: {
-        label: "My Memberships"
+        label: "My Memberships",
+        emptyState: {
+          title: "No organizations yet",
+          message: "You haven't joined any organizations."
+        }
       }
     },
     _actions: {
@@ -1354,7 +1358,11 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
     },
     _views: {
       recent: {
-        label: "Recent"
+        label: "Recent",
+        emptyState: {
+          title: "No events",
+          message: "No notification events have been emitted."
+        }
       },
       by_topic: {
         label: "By Topic"
@@ -1391,23 +1399,6 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       size: {
         label: "大小（字节）"
       },
-      share_type: {
-        label: "共享类型",
-        help: "viewer | collaborator | inferred（继承自父记录）",
-        options: {
-          viewer: "查看者",
-          collaborator: "协作者",
-          inferred: "推断"
-        }
-      },
-      visibility: {
-        label: "可见性",
-        options: {
-          internal: "内部",
-          all_users: "全部用户",
-          shared_users: "共享用户"
-        }
-      },
       uploaded_by: {
         label: "上传人"
       },

packages/platform-objects/src/audit/sys-attachment.object.ts

@@ -17,8 +17,11 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
  *  - `parent_id` is the parent record's primary key.
  *  - `(parent_object, parent_id)` is the natural index for the
  *    "files on this record" lookup.
- *  - `share_type` follows the Salesforce convention: V = Viewer,
- *    C = Collaborator, I = Inferred (inherited from parent record).
+ *  - Access is derived from the PARENT record (Salesforce semantics),
+ *    enforced by service-storage's attachment access hooks (#2755).
+ *    Salesforce's `ShareType`/`Visibility` dials were modeled here in v1
+ *    but had no runtime consumer — removed per ADR-0049 enforce-or-remove;
+ *    reintroduce them together with their enforcement if ever needed.
  *
  * @namespace sys
  */
@@ -90,26 +93,6 @@ export const SysAttachment = ObjectSchema.create({
       group: 'File',
     }),
 
-    // ── Sharing ────────────────────────────────────────────────
-    share_type: Field.select(
-      ['viewer', 'collaborator', 'inferred'],
-      {
-        label: 'Share Type',
-        defaultValue: 'viewer',
-        description: 'viewer | collaborator | inferred (inherited from parent record)',
-        group: 'Sharing',
-      },
-    ),
-
-    visibility: Field.select(
-      ['internal', 'all_users', 'shared_users'],
-      {
-        label: 'Visibility',
-        defaultValue: 'internal',
-        group: 'Sharing',
-      },
-    ),
-
     // ── Authoring ──────────────────────────────────────────────
     uploaded_by: Field.lookup('sys_user', {
       label: 'Uploaded By',

packages/rest/src/rest-server.ts

@@ -106,6 +106,20 @@ export function mapDataError(error: any, object?: string): { status: number; bod
             },
         };
     }
+    // Attachment access gates (#2755): service-storage's engine hooks reject
+    // sys_attachment writes fail-closed when the caller cannot see the parent
+    // record (create) or is neither the uploader nor a parent editor
+    // (delete). Same mapping rationale as the capability gates above.
+    if (error?.code === 'ATTACHMENT_PARENT_ACCESS' || error?.code === 'ATTACHMENT_DELETE_DENIED') {
+        return {
+            status: 403,
+            body: {
+                error: error?.message ?? 'Attachment access denied',
+                code: error.code,
+                ...(error?.object || object ? { object: error?.object ?? object } : {}),
+            },
+        };
+    }
     // Short-circuit: explicit security denial → 403. Match by `code` /
     // `name` to avoid pulling a runtime dependency on plugin-security.
     if (

packages/rest/src/rest.test.ts

@@ -2110,6 +2110,36 @@ describe('mapDataError — schema/constraint envelopes', () => {
     expect(r.body.object).toBe('crm_lead');
   });
 
+  // #2755: attachment access gates from service-storage's engine hooks —
+  // same generic-data-path rationale as the capability gates above.
+  it('maps ATTACHMENT_PARENT_ACCESS → 403 with the parent object', () => {
+    const r = mapDataError(
+      Object.assign(new Error('Cannot attach to crm_lead/rec1: the parent record does not exist or you do not have access to it'), {
+        code: 'ATTACHMENT_PARENT_ACCESS',
+        status: 403,
+        object: 'crm_lead',
+      }),
+      'sys_attachment',
+    );
+    expect(r.status).toBe(403);
+    expect(r.body.code).toBe('ATTACHMENT_PARENT_ACCESS');
+    expect(r.body.object).toBe('crm_lead');
+  });
+
+  it('maps ATTACHMENT_DELETE_DENIED → 403', () => {
+    const r = mapDataError(
+      Object.assign(new Error('Cannot delete attachment a1: only the uploader or a user who can edit the parent record (crm_lead/rec1) may delete it'), {
+        code: 'ATTACHMENT_DELETE_DENIED',
+        status: 403,
+        object: 'crm_lead',
+      }),
+      'sys_attachment',
+    );
+    expect(r.status).toBe(403);
+    expect(r.body.code).toBe('ATTACHMENT_DELETE_DENIED');
+    expect(r.body.object).toBe('crm_lead');
+  });
+
   it('maps SQLite "has no column named" → 400 INVALID_FIELD with the field', () => {
     const r = mapDataError(
       sqliteError(