fix(core): the managed clamp also clears a plain allowTransfer where the guard refuses the update

The super-user wildcard fold copies the transfer bit onto every guarded
object it covers, so the platform admin was served can(object, 'transfer')
true where the guard maps transfer to edit and refuses it. The clamp now
clears allowTransfer unless edit is opted in. The plugin-security
agreement table forgives transfer as one of the clamp's own verbs, and
gains a row with explicit modifyAllRecords entries on guarded objects.

Claude-Session: https://claude.ai/code/session_01Utp6CZUqByp4kJMhCQDWZ2
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/30440-managed-clamp-modify-all.md

@@ -2,13 +2,14 @@
 '@objectstack/core': patch
 ---
 
-fix(core): effective object permissions on a guarded managed object no longer grant edit, delete or transfer through `modifyAllRecords` where the write guard refuses them
+fix(core): effective object permissions on a guarded managed object grant no edit, delete or transfer the write guard refuses, `modifyAllRecords` included
 
 Clause-②: yes (widening)
 Metadata-protocol: none
 
-The managed write clamp behind `/auth/me/permissions` and `ISecurityService.getEffectiveObjectPermissions` cleared `allowEdit`, `allowCreate` and `allowDelete` on an object in a guarded `managedBy` bucket (`better-auth`, `engine-owned`, `append-only`) that does not opt the verb in through `userActions`, but left `modifyAllRecords`, which grants edit, delete and transfer on its own. A permission set naming such an object with `{ modifyAllRecords: true }` therefore made `current_user.can(object, 'edit' | 'delete' | 'transfer')` answer `true` while the write guard refused each of those writes.
+The managed write clamp behind `/auth/me/permissions` and `ISecurityService.getEffectiveObjectPermissions` cleared `allowEdit`, `allowCreate` and `allowDelete` on an object in a guarded `managedBy` bucket (`better-auth`, `engine-owned`, `append-only`) that does not opt the verb in through `userActions`, but left two grants the write guard refuses:
 
-Where the guard refuses `edit` or `delete`, `modifyAllRecords` is now lowered to `viewAllRecords` (the read it implies, so read is unchanged), and each verb the object still opts in is kept as its plain bit: an object opting `edit` in (such as `sys_user`) keeps edit and transfer and loses delete; an object opting nothing in keeps read only. An object opting both `edit` and `delete` in keeps `modifyAllRecords`. The external write clamp lowers it through the same helper.
+- **`modifyAllRecords`**, which grants edit, delete and transfer on its own. A permission set naming such an object with `{ modifyAllRecords: true }` made `current_user.can(object, 'edit' | 'delete' | 'transfer')` answer `true` while every one of those writes was refused. Where the guard refuses `edit` or `delete`, it is now lowered to `viewAllRecords` (the read it implies, so read is unchanged), and each verb the object still opts in is kept as its plain bit: an object opting `edit` in (such as `sys_user`) keeps edit and transfer and loses delete; an object opting nothing in keeps read only. An object opting both `edit` and `delete` in keeps `modifyAllRecords`. The external write clamp lowers it through the same helper.
+- **`allowTransfer`**, which now follows `edit`: an owner change is an update, refused unless `edit` is opted in. This also corrects a super-user wildcard admin, who was answered `can(object, 'transfer')` `true` on every guarded object that does not opt `edit` in.
 
 No write changes: the guard refused each of these before and still does. Only the served capability answer, and the console buttons that read it, now match it.

packages/core/src/security/effective-object-permissions.test.ts

@@ -591,24 +591,34 @@ describe('[#30440] a guarded managed object grants no verb its write guard refus
     expect(can(map.sys_feed_note)).toEqual({ allowRead: true, allowCreate: false, allowEdit: true, allowDelete: true, allowTransfer: true });
   });
 
+  it('a plain allowTransfer on an object not opting edit in answers no transfer; opting edit in keeps it', () => {
+    const map: any = buildEffectiveObjectPermissions(
+      [{ objects: { sys_automation_run: { allowRead: true, allowTransfer: true }, sys_user: { allowRead: true, allowTransfer: true } } }],
+      source,
+    );
+    expect(objectPermissionGrants(map.sys_automation_run, 'allowTransfer')).toBe(false);
+    expect(objectPermissionGrants(map.sys_automation_run, 'allowRead')).toBe(true);
+    expect(objectPermissionGrants(map.sys_user, 'allowTransfer')).toBe(true);
+  });
+
   it('CONTROL: the same entry on an unguarded object keeps every verb modifyAllRecords grants', () => {
     const map: any = buildEffectiveObjectPermissions([{ objects: { crm_lead: { modifyAllRecords: true } } }], source);
     expect(map.crm_lead.modifyAllRecords).toBe(true);
     expect(can(map.crm_lead)).toEqual({ allowRead: true, allowCreate: false, allowEdit: true, allowDelete: true, allowTransfer: true });
   });
 
-  it('CONTROL: the super-user wildcard fold answers as before', () => {
+  it('CONTROL: the super-user wildcard fold answers as before, transfer on the object opting nothing in aside', () => {
     const map: any = buildEffectiveObjectPermissions(
       [{ objects: { '*': { allowRead: true, viewAllRecords: true, modifyAllRecords: true } } }],
       source,
     );
     expect(can(map.crm_lead)).toEqual({ allowRead: true, allowCreate: false, allowEdit: true, allowDelete: true, allowTransfer: true });
     expect(can(map.sys_user)).toEqual({ allowRead: true, allowCreate: false, allowEdit: true, allowDelete: false, allowTransfer: true });
     expect(can(map.sys_feed_note)).toEqual({ allowRead: true, allowCreate: false, allowEdit: true, allowDelete: true, allowTransfer: true });
-    // The fold copies the bits the wildcard grants (transfer among them), never
-    // modifyAllRecords itself, so the lowering never reaches a folded entry.
-    expect(can(map.sys_automation_run)).toEqual({ allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false, allowTransfer: true });
+    // The fold copies the bits the wildcard grants, never modifyAllRecords itself.
     for (const name of Object.keys(SCHEMAS)) expect(map[name], name).not.toHaveProperty('modifyAllRecords');
+    // The one answer that moves: the folded transfer bit, on the object whose guard refuses the update.
+    expect(can(map.sys_automation_run)).toEqual({ allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false, allowTransfer: false });
   });
 });
 

packages/core/src/security/effective-object-permissions.ts

@@ -240,13 +240,17 @@ const GUARDED_WRITE_BUCKETS: ReadonlySet<string> = new Set(['better-auth', 'engi
  * stands (an admin CAN write them via the data API, and the hint must not
  * under-report that).
  *
- * [#30440] `modifyAllRecords` grants edit, delete and transfer on its own (the
- * spec's `objectPermissionGrants`), so no `allow*: false` beside it takes any of
- * them away. Where the guard refuses `edit` or `delete` it is lowered by
- * {@link lowerModifyAllRecords}: to `viewAllRecords`, the read it implies, plus
- * the plain bit of each verb the object still opts in — `allowTransfer` with
- * `edit`, since an owner change is an update. Where `edit` and `delete` are
- * both opted in it grants nothing the guard refuses, and stays.
+ * [#30440] Every verb the guard refuses is refused whatever grants it:
+ *  - `allowTransfer` follows `edit` — an owner change is an update, which the
+ *    guard refuses unless `edit` is opted in; the super-user wildcard fold
+ *    copies the transfer bit onto every entry it covers;
+ *  - `modifyAllRecords` grants edit, delete and transfer on its own (the
+ *    spec's `objectPermissionGrants`), so no `allow*: false` beside it takes
+ *    any of them away. Where the guard refuses `edit` or `delete` it is lowered
+ *    by {@link lowerModifyAllRecords}: to `viewAllRecords`, the read it
+ *    implies, plus the plain bit of each verb the object still opts in. Where
+ *    `edit` and `delete` are both opted in it grants nothing the guard
+ *    refuses, and stays.
  */
 export function clampManagedObjectWrites(
   objects: Record<string, any>,
@@ -265,6 +269,7 @@ export function clampManagedObjectWrites(
     // would clamp away a legitimate `{ enabled: true, visibleWhen: … }`.
     if (!isWriteOptedIn(ua.create)) acc.allowCreate = false;
     if (!del) acc.allowDelete = false;
+    if (!edit) acc.allowTransfer = false;
     lowerModifyAllRecords(acc, { allowEdit: edit, allowDelete: del, allowTransfer: edit });
   }
 }

packages/plugins/plugin-security/src/get-effective-object-permissions.test.ts

@@ -354,7 +354,8 @@ describe('[#18783] the engine is handed the same producer', () => {
  *    the create / edit / delete verbs may read NARROWER than the evaluator: that
  *    is the managed-write clamp, the engine write guard the permission sets do not
  *    model. There the pin holds the refuse direction only — the map never grants
- *    what the evaluator refuses.
+ *    what the evaluator refuses. [#30440] `transfer` is one of them: an owner
+ *    change is an update, which the guard refuses unless the object opts `edit` in.
  *
  * [#20134] Subjects whose sets carry a SUPER-USER wildcard are held by the same
  * table, one row per shape: the shipped platform admin and walled org admin, a
@@ -473,6 +474,15 @@ describe('[#20083] parity: can() over the member\'s map answers what checkObject
       shipped('admin_full_access'), shipped('organization_admin'), shipped('member_default'),
     ],
     // [#20135] The export slot's own shapes.
+    // [#30440] An explicit modify-all entry on guarded managed objects: one opting
+    // `edit` in (sys_user), one opting nothing in (sys_member), one private (sys_secret).
+    '[#30440] explicit modifyAllRecords entries on guarded managed objects': [
+      authored('managed_modify_all', {
+        [SysUser.name]: { modifyAllRecords: true },
+        [SysMember.name]: { modifyAllRecords: true },
+        [SysSecret.name]: { modifyAllRecords: true },
+      }),
+    ],
     'platform admin beside a plain export-only wildcard': [shipped('admin_full_access'), authored('exporter', { '*': { allowExport: true } })],
     'one set: an exporting wildcard AND an explicit entry without the grant': [
       authored('same_export', { '*': { allowRead: true, allowExport: true }, crm_lead: { allowRead: true } }),
@@ -484,7 +494,7 @@ describe('[#20083] parity: can() over the member\'s map answers what checkObject
     allowTransfer: 'transfer', allowExport: 'export',
   };
   const GUARDED = new Set(['better-auth', 'engine-owned', 'append-only']);
-  const CLAMPED = new Set(['allowCreate', 'allowEdit', 'allowDelete']);
+  const CLAMPED = new Set(['allowCreate', 'allowEdit', 'allowDelete', 'allowTransfer']);
   const USER = { id: 'u_parity', positions: [] as string[] };
   const evaluator = new PermissionEvaluator();