Repository navigation
share-link 契约:enforcement 路径改收完整 ExecutionContext,窄的 ShareLinkExecutionContext 只服务路由 401 —— #6206 裁决 A 案的契约半边 #6430
Description
Part of #6206(维护者 2026-08-07 裁决 A 案,见 #6206 comment 5219847367)
要做什么
packages/spec/src/contracts/share-link-service.ts(:100-112 的 ShareLinkExecutionContext,仅五字段)按裁决调整:share-link 的可见性校验(enforcement)路径必须收完整的 resolveAuthzContext 信封(含 accessible_org_ids、org_user_ids、systemPermissions、posture、tabPermissions),窄类型可保留但只准服务路由自身的 401 判断,不得再进任何 enforcement 路径——契约形状要让这条边界可见(如可见性校验的签名改收 ExecutionContext,并在 TSDoc 写明窄类型的边界)。
依据
- ADR-0095 D2:posture 解析一次、随上下文流动、永不在 enforcement 处重推;
- 裁决理由原文:裁剪信封喂 enforcement 是 bypass 形状的模式,本例是同族第三处组装(前两处 两处手写的 ExecutionContext 组装已漂移:REST 传输不带
principalKind/onBehalfOf,而 explain / security 会读它 #6071/HookContext 契约表把before*的input.options记成 DriverOptions —— 实测那里仍是调用方的 engine options(含 where),两个 break-glass 守卫正读它 #5997),治理默认收敛到完整信封,不留 per-site 子集; - 今天的失效是 fail-closed(
group姿态下 share-link 创建全量 403,可用性缺陷非泄露),tenant-layer.ts 的 TSDoc 自证(accessibleOrgIds 在 group 姿态缺席即拒)。
排序(contract-first)
本卡先落;plugin-sharing 消费半边(sharing-plugin.ts contextFromRequest / share-link-service.ts 喂 engine.find 处)留 identity 车道,已挂 Blocked-by: 指向本卡。消费半边的 before-red 证据将同时兑现分诊留下的 repro 义务(group 姿态 403 实测,修后转 200)。
落点 packages/spec ⇒ 归 spec 座位;本卡由 identity 车道 PM 按跨座位转移协议代立(session_01JwwiU9bjhwy2SWj13ho8uv),domain:* 留分诊补。
Activity
os-zhuang commentedon Aug 7, 2026
Triage — routing label added:
domain:spec(blind-spot A: this card sat inpm:queuewith nodomain:*, i.e. queued but unroutable — no lane could see it as theirs.)spec, notspec-surface. The change is to the shape of a contract, not to the prose describing one:ShareLinkExecutionContextatpackages/spec/src/contracts/share-link-service.ts:100gets replaced by the fullExecutionContextenvelope on the enforcement path, and the narrow type's remaining legality is narrowed to route-level 401. A caller that compiles today stops compiling (or stops being accepted) after it, so the accept face moves ⇒domain:spec. The split criterion insidepackages/specis exactly this: only a change where every input legal before stays legal byte-for-byte afterwards isspec-surface— a TSDoc note about the boundary rides along with this card rather than making it a text-face card.Stale-premise check against
origin/main(fetched,26b72e0):ShareLinkExecutionContextis still the five-field interface at:100(userId/tenantId/isSystem/positions/permissions) and is still the parameter type ofcreateLink(:123),revokeLink(:126) andlistLinks(:129). Ruling anchor #6206 (comment 5219847367) intact; nothing has landed on this file since.Ordering is already correct, no
pm:blockedneeded here. This is the head of the chain — theplugin-sharingconsumer half sits in the identity lane carryingBlocked-by:pointed at this card, which is the contract-first order the protocol asks for. Filed by the identity lane PM via the cross-seat transfer protocol;packages/spechas one owner regardless of who needs it, so the claim belongs to thedomain:specseat (#6017).On
target:v17: kept, and independently re-checked rather than inherited — criterion ① holds (ingroupposture, share-link creation returns a blanket 403 today, a shipped-surface availability failure a user hits). One process note, no action needed on this card:target:*is produced by the triage seat alone, the same single-producer rule asdomain:*; the label arrived here from the filing lane. It is correct, so it stays — flagging only so the producer boundary does not erode by precedent.Duplicate search across all three repos (
ShareLinkExecutionContext, share-link enforcement envelope,resolveAuthzContexttrimming): parent #6206 and the two prior assemblies it names (#6071 / #5997) — this is the third instance of the same shape, which is the ruling's own rationale, not a duplicate.本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
test(spec): contracts and conversions test titles state each cited de…