From 19e8dac134427f627a998e4964abfa6991d6ec38 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 25 Oct 2026 14:32:56 +0000 Subject: [PATCH] fix(security): every member reads the signing entities MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit clm_contract.our_entity is a required lookup to sys_business_unit since #118, and no CLM set granted read on that platform object, so a member who is not an administrator was refused the launch dialog's "Our signing entity" picker (403) and saw the entity's raw id on the record page. clm_requester, which every member holds through the everyone anchor, now grants object-level read on sys_business_unit — read only, no create, edit or delete. A read grant is not a high-privilege bit, so the anchor binding stays valid. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_017nzWFRUo2U7evMkPdVniAn --- src/profiles/requester.profile.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/profiles/requester.profile.ts b/src/profiles/requester.profile.ts index 92d8ef8..8c1e59a 100644 --- a/src/profiles/requester.profile.ts +++ b/src/profiles/requester.profile.ts @@ -110,6 +110,17 @@ export const RequesterSet = definePermissionSet({ sys_activity: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, sys_attachment: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, sys_approval_request: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, + // `clm_contract.our_entity` is a required lookup to the platform's + // business units (the active company-kind ones are the signing entities), + // and `member_default` grants no read on them. Without this line every + // non-admin member got `403 PERMISSION_DENIED` in the launch dialog's + // "Our signing entity" picker — so could not launch a contract — and the + // record page showed the entity's raw id (issue #124). It sits here + // because every member holds this set, the legal, finance and records + // positions included. Read only: units are maintained in Setup → Business + // Units by an administrator. The object's sharing baseline is org-wide, + // so the read reaches the organization's own units and nothing else. + sys_business_unit: { allowCreate: false, allowRead: true, allowEdit: false, allowDelete: false }, }, fields: { ...readOnly(Contract, CONTRACT_STAMPED_FIELDS),