feat(sharing): a record's share-manager may revoke any share-link on that record (ADR-0111 D8, framework) (#3986)

ShareLinkService.revokeLink now admits a record share-manager (owner / modifyAllRecords via the late-bound canManageShares probe), not only the link's creator — fails closed when the probe is absent or throws. Mint authority (publicSharing opt-in + record visibility) documented as the D8 decision it already enforced.

Author: os-zhuang

.changeset/adr-0111-share-link-reshare.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/plugin-sharing": minor
+---
+
+feat(sharing): a record's share-manager may revoke any share-link on that record (ADR-0111 D8)
+
+`ShareLinkService.revokeLink` was creator-or-system only, so a record's owner or
+a Modify-All admin could not kill a link someone else minted on their record —
+their record's exposure, but not their link to revoke. Revoke authority now
+also admits a record **share-manager**, probed via the sharing service's
+late-bound `canManageShares` (owner / `modifyAllRecords`). The probe fails
+closed: a deployment without it (or a throwing probe) keeps the pre-D8
+creator-only behaviour. Mint authority is unchanged and now documented as the
+D8 decision it always enforced — the object's `publicSharing` opt-in AND the
+caller's visibility of the record.

content/docs/protocol/objectql/security.mdx

@@ -324,6 +324,14 @@ publicSharing:
   maxExpiryDays: 30
 ```
 
+**Who may mint and revoke** (ADR-0111 D8). Minting a link requires the object's
+`publicSharing` opt-in **and** that the caller can see the record — an opted-in
+object deliberately delegates re-share power to anyone who can view the row.
+Revoking a link is allowed for the link's **creator**, a **record share-manager**
+(the record's owner or a `modifyAllRecords` admin — the same authority as
+`canManageShares`), or system context: a link someone else minted on your record
+is your record's exposure to kill, not only its creator's.
+
 ---
 
 ## 6. Field-Level Encryption

docs/adr/0111-record-share-management-authority-and-verb-boundary.md

@@ -1,6 +1,6 @@
 # ADR-0111: Record-share management authority and the verb boundary — sharing needs "who may manage a share" and "which verbs a level grants"
 
-**Status**: Accepted (2026-07-30) — **P0 + P1 implemented**. P0 (D1/D2/D4/D5/D6/D7/D9): `canManageShares` + `hasWriteBypass`, verified by the #3902 Mallory reproduction. P1 (D3, the verb boundary): `canDelete` + verb-split `buildWriteFilter` in `plugin-sharing/src/sharing-service.ts`, routed by the middleware and `/security/explain`, verified by the "edit share cannot delete" suite in `plugin-sharing/src/sharing-service.test.ts`. **D8 (share-link rulings) and the DEPTH management extension (D1 D-future) are not yet implemented** — they land as the follow-up PRs this ADR's rollout section names.
+**Status**: Accepted (2026-07-30) — **P0 + P1 + D8 (framework) implemented**. P0 (D1/D2/D4/D5/D6/D7/D9): `canManageShares` + `hasWriteBypass`, verified by the #3902 Mallory reproduction. P1 (D3, the verb boundary): `canDelete` + verb-split `buildWriteFilter` in `plugin-sharing/src/sharing-service.ts`, routed by the middleware and `/security/explain`, verified by the "edit share cannot delete" suite. D8 (share-link re-share): `ShareLinkService.revokeLink` now admits a record share-manager via the late-bound `canManageShares` probe, and the mint-authority ruling (publicSharing opt-in + visibility) is enforced as before — verified in `share-link-service.test.ts`. **Still open**: the cloud-side D8 wiring (`HttpDispatcher.handleShareLinks` + a `.objectstack-sha` bump, in `objectstack-ai/cloud`) and the DEPTH management extension (D1 D-future) — the follow-ups this ADR's rollout section names.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove — a security property that parses but enforces nothing is worse than absent), [ADR-0057](./0057-erp-authorization-core-business-units-and-scope-depth.md) (DEPTH scopes + the `sys_record_share` / `sys_sharing_rule` split), [ADR-0066](./0066-unified-authorization-model.md) (unified capability model; `modifyAllRecords` super-user bit), [ADR-0078](./0078-no-silently-inert-metadata.md) (no silently inert metadata — a persisted share level or recipient type that no gate consults is exactly this), [ADR-0090](./0090-permission-model-v2-concept-convergence.md) (D1 secure-default OWD, D4 retired aliases, D10 delegated identity intersection), [ADR-0091](./0091-grant-lifecycle-and-recertification.md) (time-boxed grants — the lifecycle axis this ADR deliberately does not re-open)
 **Consumers**: `@objectstack/plugin-sharing` (`sharing-service.ts`, `sharing-rule-service.ts`, `share-link-service.ts`, `sharing-plugin.ts`), `@objectstack/plugin-security` (`ISecurityService` — a write-bypass probe), `@objectstack/rest` (`rest-server.ts` sharing / sharing-rule / share-link routes), `@objectstack/spec` (`contracts/sharing-service.ts`, `security/capabilities.ts`)

packages/plugins/plugin-sharing/src/share-link-service.test.ts

@@ -189,6 +189,54 @@ describe('ShareLinkService', () => {
       expect(engine._tables.sys_share_link[0].revoked_at).not.toBeNull();
     });
 
+    // [ADR-0111 D8] A record's share-manager (owner / Modify All) may revoke a
+    // link someone ELSE minted on their record — the manage probe is consulted
+    // when the caller is neither the creator nor system.
+    it('a record share-manager may revoke a link another user minted', async () => {
+      const seen: Array<[string, string, string]> = [];
+      const svc = new ShareLinkService({
+        engine: engine as any,
+        canManageShares: async (object, recordId, ctx: any) => {
+          seen.push([object, recordId, ctx.userId]);
+          return ctx.userId === 'manager'; // manager can manage c1; nobody else
+        },
+      });
+      const link = await svc.createLink(
+        { object: 'ai_conversations', recordId: 'c1', audience: 'link_only', permission: 'view' },
+        { userId: 'creator' },
+      );
+      // A bystander who cannot manage the record is still denied.
+      await expect(svc.revokeLink(link.id, { userId: 'bystander' })).rejects.toMatchObject({ status: 403 });
+      expect(engine._tables.sys_share_link[0].revoked_at).toBeNull();
+      // The record's manager can, though they did not create the link.
+      await expect(svc.revokeLink(link.id, { userId: 'manager' })).resolves.toBeUndefined();
+      expect(engine._tables.sys_share_link[0].revoked_at).not.toBeNull();
+      // The probe was asked about the LINK's (object, record), not anything else.
+      expect(seen).toContainEqual(['ai_conversations', 'c1', 'manager']);
+    });
+
+    it('without a manage probe (pre-D8 / probe-less deployment), only creator and system revoke', async () => {
+      // Default service has no canManageShares — a non-creator is denied even
+      // if they would be a manager, because the deployment cannot ask.
+      const link = await service.createLink(
+        { object: 'ai_conversations', recordId: 'c1', audience: 'link_only', permission: 'view' },
+        { userId: 'creator' },
+      );
+      await expect(service.revokeLink(link.id, { userId: 'someone_else' })).rejects.toMatchObject({ status: 403 });
+    });
+
+    it('a throwing manage probe fails CLOSED (denies a non-creator)', async () => {
+      const svc = new ShareLinkService({
+        engine: engine as any,
+        canManageShares: async () => { throw new Error('probe down'); },
+      });
+      const link = await svc.createLink(
+        { object: 'ai_conversations', recordId: 'c1', audience: 'link_only', permission: 'view' },
+        { userId: 'creator' },
+      );
+      await expect(svc.revokeLink(link.id, { userId: 'bystander' })).rejects.toMatchObject({ status: 403 });
+    });
+
     it('an HTTP caller cannot mint a link for a record it cannot see (403, not 404)', async () => {
       // The record-access re-read runs under the caller context; a record the
       // caller cannot see (here: does not exist) yields a fail-closed 403 for an

packages/plugins/plugin-sharing/src/share-link-service.ts

@@ -170,6 +170,18 @@ export interface ShareLinkServiceOptions {
    * without `publicSharing.enabled=true` are rejected with 422.
    */
   permissive?: boolean;
+  /**
+   * [ADR-0111 D8] Late-bound record-share management probe (the sharing
+   * service's `canManageShares`). Lets a record's OWNER / Modify-All admin
+   * revoke a link someone else minted on their record — not just the link's
+   * creator. Absent → only the creator (and system) may revoke, the pre-D8
+   * behaviour, so a deployment without the sharing service degrades safely.
+   */
+  canManageShares?: (
+    object: string,
+    recordId: string,
+    context: ShareLinkExecutionContext,
+  ) => Promise<boolean>;
 }
 
 /**
@@ -186,12 +198,18 @@ export class ShareLinkService implements IShareLinkService {
   private readonly permissive: boolean;
   private readonly hashPassword: (plain: string) => Promise<string>;
   private readonly verifyPassword: (plain: string, hash: string) => Promise<boolean>;
+  private readonly canManageShares?: (
+    object: string,
+    recordId: string,
+    context: ShareLinkExecutionContext,
+  ) => Promise<boolean>;
 
   constructor(opts: ShareLinkServiceOptions) {
     this.engine = opts.engine;
     this.permissive = opts.permissive ?? false;
     this.hashPassword = opts.hashPassword ?? defaultHashPassword;
     this.verifyPassword = opts.verifyPassword ?? defaultVerifyPassword;
+    this.canManageShares = opts.canManageShares;
   }
 
   async createLink(
@@ -204,6 +222,11 @@ export class ShareLinkService implements IShareLinkService {
     const schema = this.engine.getSchema?.(input.object);
     const policy = getPolicy(schema);
 
+    // [ADR-0111 D8] Mint authority = the object's `publicSharing` opt-in (this
+    // check) AND the caller's visibility of the record (the RLS-scoped read
+    // below). An object that opts into publicSharing deliberately delegates
+    // re-share power to anyone who can SEE the record — a stated decision, not
+    // an accident. Objects that do not opt in cannot be link-shared at all.
     if (!policy.enabled && !this.permissive && !context.isSystem) {
       throw makeError(
         422,
@@ -289,16 +312,29 @@ export class ShareLinkService implements IShareLinkService {
     const filter = idOrToken.startsWith('shl_') ? { id: idOrToken } : { token: idOrToken };
     const rows = await this.engine.find('sys_share_link', {
       where: filter,
-      fields: ['id', 'revoked_at', 'created_by'],
+      // object_name / record_id are needed for the [ADR-0111 D8] record-manager
+      // revoke path below.
+      fields: ['id', 'revoked_at', 'created_by', 'object_name', 'record_id'],
       limit: 1,
       context: SYSTEM_CTX,
     } as any);
     const row = Array.isArray(rows) ? (rows[0] as any) : undefined;
     if (!row) return; // No-op when missing
-    // [Finding-2] Only the link's creator may revoke it (internal/system callers
-    // bypass). Previously the caller context was ignored, so any client could
-    // revoke any user's link by id/token (sharing DoS).
-    if (!context.isSystem && row.created_by !== context.userId) {
+
+    // Who may revoke this link:
+    //   - system / internal callers (bypass),
+    //   - the link's CREATOR ([Finding-2]: the caller context used to be
+    //     ignored, so any client could revoke any user's link — a sharing DoS),
+    //   - [ADR-0111 D8] a record SHARE-MANAGER (the record's owner or a
+    //     Modify-All admin): a link someone else minted on your record is your
+    //     record's exposure to kill, not only its creator's. Probed via the
+    //     late-bound sharing service; absent → creator-only (pre-D8 behaviour).
+    let permitted = context.isSystem === true || row.created_by === context.userId;
+    if (!permitted && this.canManageShares && row.object_name && row.record_id) {
+      permitted = await this.canManageShares(String(row.object_name), String(row.record_id), context)
+        .catch(() => false);
+    }
+    if (!permitted) {
       throw makeError(403, 'FORBIDDEN', 'Not permitted to revoke this share link');
     }
     if (row.revoked_at) return; // Already revoked

packages/plugins/plugin-sharing/src/sharing-plugin.ts

@@ -489,7 +489,17 @@ export class SharingServicePlugin implements Plugin {
       // access can set `registerShareLinkRoutes: false` and call the
       // service via `ctx.getService('shareLinks')`.
       try {
-        this.linkService = new ShareLinkService({ engine: engine as SharingEngine });
+        this.linkService = new ShareLinkService({
+          engine: engine as SharingEngine,
+          // [ADR-0111 D8] Let a record's share-manager (owner / Modify All)
+          // revoke a link someone else minted on their record. `this.service`
+          // is always constructed above — even under `enforce: false` (the
+          // multi-tenant share-link-only config), where only the RLS middleware
+          // is skipped — so the probe is available in every posture.
+          canManageShares: this.service
+            ? (o, r, c) => this.service!.canManageShares(o, r, c as any)
+            : undefined,
+        });
         ctx.registerService('shareLinks', this.linkService);
 
         if (this.options.registerShareLinkRoutes !== false) {