Repository navigation
[permissions] 行级读可见范围无法按业务字段收窄:viewAllRecords 全有/全无两档之间缺共享规则 #4376
Description
现象
行级「读」可见范围无法按业务字段收窄:权限集只有 viewAllRecords 全有/全无两档,行级门只认 created_by,没有「按 executor / manager 等业务字段的共享规则」元数据。
实测证据(17.0.0-rc.0,真人 UI)
现场工人账号登录 console 打开「派工单」列表 → 看到全部 8 条,其中 7 条的执行责任人是别人。而执行链对象为了让「Hook 建单后执行人可写」必须配 *_ALL(含 viewAllRecords),读范围随之全开——写侧可用应用层 Hook 守住(400 拦截),读侧应用层无手段。
影响
「执行责任人仅可见本人的派工单/排班计划」类需求无法交付;与列表导出叠加后,越权可见还能成批带走。
建议
提供按字段的行级共享规则(如 owner-field 声明或 criteria-based sharing:record.executor == current_user.id || record.manager == current_user.id 之类的读谓词),让 viewAllRecords 之下有中间档。#2776(Permission Model v2 parking lot)如已覆盖此项可并入。
下游登记:os-project-titanwind-ehr PLAT-DEF-022。
Activity
baozhoutao commentedon Jul 31, 2026
撤回:此条未经下游 PM 确认即批量提报,先关闭;后续由 PM 决定是否重提。
os-justin commentedon Sep 1, 2026
state_reasoncorrectedcompleted→not_planned(close date and history untouched). Provenance, three parts: (1) the census on #14081 confirmed this close as a withdrawal — the byte-identical 「撤回…先关闭」 batch comment, posted seconds after #4375's — with this card's gap (row-level read visibility cannot be narrowed by a business field) never re-raised anywhere; (2) the seat review of record on #14081 (comment 5490049186, 2026-09-01) adjudicated the 4 confirmed cases as normal single-write dispositions; (3) executed by the skills-lane PM seat, sessionsession_01Whev4BkZ4BRcgiXYo4muWP, performing the vacant triage seat's mechanical disposition. The gap itself is tracked by the fresh unassigned finding the #14081 review ordered filed (premise explicitly unverified against today's plugin-sharing surface) — this correction only stops the closed card from reading as "shipped".Generated by Claude Code