fix(plugin-sharing): name the federated-anchor remedy before the model, and reconcile the sharing-rules page with D7's real owner_id

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WV4cyFB75QwwCDu3S5GNZ

Author: claude

content/docs/permissions/sharing-rules.mdx

@@ -137,17 +137,18 @@ the rows it owns and the rows granted to it:
   the object (for example `supplier in current_user.<key>`). Such a policy
   lifts the owner-only floor for that object, and the policy bounds the rows.
 
-On a `public_read_write` object, or a system object with no `sharingModel`, a
-share or sharing rule takes effect for external recipients only: the grant is
-accepted for a recipient who is an `external` member of the record's
+On a `public_read_write` object, or a system object with no `sharingModel`,
+whose `owner_id` is real, a share or sharing rule takes effect for external
+recipients only: the grant is accepted for a recipient who is an `external` member of the record's
 organization, every other recipient is refused with `SHARING_NOT_ENABLED`
 (422), and a rule's evaluation writes rows for its external recipients alone.
 
-A sharing rule on an object that no sharing gate consults for any recipient (a
-system object with no `owner_id`, such as `sys_session`; a public object with no
-owner; a `controlled_by_parent` detail; a bypass object) is refused when it is
-saved, with `SHARING_NOT_ENABLED` (422) and a sentence that names the object and
-how to turn record sharing on for it. This holds for Setup's form and the
+A sharing rule on an object that no sharing gate consults for any recipient is
+refused when it is saved: an object with no real `owner_id` (a system object
+without one, such as `sys_session`, or a federated object whose `owner_id` is
+the platform's injected anchor), a `controlled_by_parent` detail, or a bypass
+object. It is refused with `SHARING_NOT_ENABLED` (422) and a sentence that
+names the object and how to turn record sharing on for it. This holds for Setup's form and the
 `/data` door as well as `POST /api/v1/sharing/rules`, and for an edit that moves
 a rule onto such an object. A rule saved before this check keeps its row and
 can still be switched off.

packages/plugins/plugin-sharing/src/sharing-rule-object-enforcement.test.ts

@@ -42,6 +42,7 @@ const ORG = 'org_30621';
 const ENFORCED = 'os30621_deal';
 const OWNERLESS = 'os30621_session';
 const PUBLIC_OWNED = 'os30621_notice';
+const PUBLIC_FEDERATED = 'os30621_ext_customer';
 
 const SYSTEM: ExecutionContext = { isSystem: true, positions: [], permissions: [] };
 const ADMIN = {
@@ -88,6 +89,12 @@ async function boot() {
     name: PUBLIC_OWNED, label: 'Notice', sharingModel: 'public_read_write',
     fields: { ...recordFields, owner_id: text('owner_id') },
   } as never);
+  // A PUBLIC federated object (ADR-0015): the registry injects `owner_id` as an
+  // anchor the remote table does not have. Registered only, never written to.
+  ql.registerObject({
+    name: PUBLIC_FEDERATED, label: 'External customer', sharingModel: 'public_read_write',
+    external: { remoteName: 'customers' }, fields: { id: { ...text('id'), primary: true }, name: text('name') },
+  } as never);
   ql.registerObject({
     name: 'sys_sharing_rule', label: 'Sharing Rule', isSystem: true,
     fields: {
@@ -102,7 +109,7 @@ async function boot() {
   const sharing = new SharingService({ engine: ql as never });
   const rules = new SharingRuleService({ engine: ql as never, sharing });
   bindRuleObjectEnforcementGuard(ql as never, sharing);
-  return { ql, rules };
+  return { ql, rules, sharing };
 }
 
 const rowFor = (object: string, name: string) => ({
@@ -169,6 +176,24 @@ describe('[#30621] the /data door refuses a sharing rule on an object without re
   });
 });
 
+describe('[#30621] the refusal sentence names the remedy for the arm that refused', () => {
+  it('a PUBLIC federated object with the injected owner anchor is told to declare a real remote owner_id', async () => {
+    const { ql, sharing } = await boot();
+    expect((ql as any).getSchema(PUBLIC_FEDERATED)?.fields?.owner_id, 'the registry injected the anchor').toBeTruthy();
+    const refusal = sharing.sharingRuleObjectRefusal(PUBLIC_FEDERATED);
+    expect(refusal).toContain(`'${PUBLIC_FEDERATED}'`);
+    expect(refusal).toMatch(/declare a real remote 'owner_id' column/);
+    // Not the generic remedy: the object already has an owner_id, and a
+    // private model would still meet the phantom-anchor refusal.
+    expect(refusal).not.toMatch(/sharingModel: 'private'/);
+    const err = await ql.insert('sys_sharing_rule', rowFor(PUBLIC_FEDERATED, 'ext_rule'), { context: ADMIN } as never)
+      .catch((x: unknown) => x as any);
+    expect(err?.code).toBe('SHARING_NOT_ENABLED');
+    expect(err?.status).toBe(422);
+    expect(await storedRules(ql)).toHaveLength(0);
+  });
+});
+
 describe('[#30621] defineRule (POST /api/v1/sharing/rules) refuses the same rule', () => {
   const input = (object: string, name: string) => ({
     name, label: name, object, recipientType: 'position', recipientId: 'sales_rep', criteria: { stage: 'won' },

packages/plugins/plugin-sharing/src/sharing-service.ts

@@ -1807,7 +1807,10 @@ export class SharingService implements ISharingService {
     if (declared === 'controlled_by_parent') {
       return 'Author the rule on its master object instead.';
     }
-    if (schema && effectiveSharingModel(schema) !== 'public' && hasOwnerField(schema) && hasPhantomOwnerAnchor(schema)) {
+    // Asked before the model: a federated object whose `owner_id` is the
+    // injected anchor already HAS that field, public or not, and a private
+    // model would still meet the phantom-anchor refusal.
+    if (schema && hasOwnerField(schema) && hasPhantomOwnerAnchor(schema)) {
       return `To use sharing rules on it, declare a real remote '${OWNER_FIELD}' column on the federated object.`;
     }
     return `To use sharing rules on it, give the object a private or read-only sharing model `