@objectstack/plugin-reports 17.0.0-rc.5 → 17.0.0-rc.6

package/CHANGELOG.md

@@ -1,5 +1,413 @@
 # @objectstack/plugin-reports
 
+## 17.0.0-rc.6
+
+### Patch Changes
+
+- f40c5b4: refactor(plugin-approvals,plugin-reports): enforcement implementations annotate the full `ExecutionContext` (#7135)
+
+  The services half of #7070, mirroring what PR #7140 did for
+  `plugin-sharing` / `plugin-audit`. #6523 converged 36 contract signatures onto
+  the complete `resolveAuthzContext` envelope, applying the #6206 ruling —
+  enforcement adjudicates on the whole envelope, never a per-site subset. The
+  implementations behind those contracts still annotated their own parameters
+  with the six-field shape the contracts used to name, so nothing they could
+  _read_ had widened.
+
+  `ApprovalService`, the approval flow-node provider and `ReportService` now
+  declare `ExecutionContext` on all 43 of those positions, and the casts the
+  narrow annotation forced are gone:
+
+  - `isOverrideActor()` read the derived `posture` (ADR-0095) through an
+    unchecked `(context as any)`. That gate decides whether a platform or tenant
+    admin may release a STUCK approval — one routed to an unstaffed position, the
+    only in-product recovery from a permanently locked record — so an erasure sat
+    directly on an enforcement input: a mistyped rung would have compiled and
+    silently denied every override. It is a declared read now.
+  - Both services' `SYSTEM_CTX` is typed as the envelope and passed as itself,
+    retiring the `SYSTEM_CTX as unknown as …` double casts at the three sites
+    that hand it to a contract method.
+  - The `(context as any).userId` / `.tenantId` reads in `ApprovalService` now
+    read declared fields.
+  - `OwnerContextResolver` returns the envelope, which is what a scheduled report
+    actually resolves for its owner (#2849 / #2980).
+
+  **No runtime behaviour changes.** The values were always complete — this
+  family's damage was type-side — so every gate answers exactly what it answered
+  before. Method parameters only WIDEN what they accept, so no caller is
+  affected, and no public export changes shape.
+
+  Casts deliberately kept, and now documented where they sit: `organizationId`
+  is not a field of the envelope at all — that spelling has its own history
+  (#5858 / `check:org-identifier`) and was held out of this change by #7070. In
+  `approval-node.ts` the single remaining assertion exists only because the
+  literal names that key; it was reduced from `as unknown as …` to a single
+  `as ExecutionContext`, which still requires the literal to be comparable to
+  the envelope.
+
+  Because a re-narrowed annotation would compile, ship and pass every test in
+  these packages, the convergence is pinned by a new compile-time module per
+  package, `exec-context-annotation.pin.ts`: it hands each parameter a fresh
+  literal naming envelope-only fields (`posture`, `accessible_org_ids`,
+  `org_user_ids`), which TypeScript's excess-property check rejects the moment a
+  parameter narrows back, plus negative cases so a parameter erased to `any`
+  cannot pass either.
+
+  The exported `SharingExecutionContext` type itself is NOT removed here: it is
+  defined in `packages/spec`, which is single-owner, so its retirement is a
+  separate follow-up.
+
+- d0d5205: refactor(core,plugin-audit,service-storage,plugin-reports): give the `__` operation-private-key convention a single owner (#7284)
+
+  `withoutOperationPrivateKeys` — the rule that a consumer forwarding a caller's
+  execution envelope to a question about a DIFFERENT object must first drop the
+  `__`-prefixed keys plugin-security stamped for the operation in flight — had been
+  hand-copied into three packages: `plugin-audit`'s comment access hooks (#7141),
+  `service-storage`'s attachment access hooks (#7145) and `plugin-reports`' report
+  service (#7204). Each carried its own `OPERATION_PRIVATE_KEY_PREFIX` and its own
+  doc block, and the prose had already diverged while the code still agreed — the
+  shape that makes a later divergence in behaviour hard to notice.
+
+  The helper now lives once, in `@objectstack/core`
+  (`security/operation-private-keys.ts`), exported from the package root. Core is
+  the only candidate all three consumers already depend on: `plugin-security` is
+  the producer of the convention and the most honest owner, but none of the three
+  depends on it and a string-prefix filter does not justify three new dependency
+  edges onto a plugin; `@objectstack/spec` is fenced off by Prime Directive #2. The
+  new home sits beside `assemble-execution-context.ts`, which owns the other end of
+  the same lifecycle — that file is where an `ExecutionContext` is built at a
+  transport entry point, this one is where it is stripped back down before being
+  forwarded.
+
+  The full reasoning moved with the code rather than being thinned: which keys the
+  middleware stamps and why each is a widening input, why they are dropped by
+  PREFIX and never by a name list, and why the fresh copy is load-bearing in both
+  directions. Each consumer keeps only its own local half — which object _its_
+  gates actually ask about — and points at the shared home.
+
+  No behaviour change: the three copies were byte-equivalent, and all three
+  packages' suites pass unchanged. Two new pins at the home cover it — the rule's
+  own behaviour, which no package-level test had ever asserted directly, and a
+  repository-shape pin that turns red if a fourth file declares its own copy.
+
+- cb466aa: Reports read with the caller's whole execution envelope, so a `group`-posture report no longer under-reports
+
+  `executeReport` rebuilt a five-field projection of the caller's `ExecutionContext`
+  (`userId` / `tenantId` / `positions` / `permissions` / `isSystem`) before handing it to
+  the engine read that produces the report — while the method's own comment promised
+  "reports execute with the caller's identity".
+
+  **Before.** `accessible_org_ids` was not in that projection, and the engine reads it by
+  name (`buildDriverOptions`, ADR-0105 D2 / #3623) to widen the driver's native tenant
+  scope to the caller's whole membership set under the `group` tenancy posture. Absent, the
+  drivers fall back to active-org equality — "fail toward isolation". So the identical query
+  returned the membership union in an interactive list view and collapsed to the active org
+  inside a **saved or scheduled** report: silently short rows, no error, nothing in the
+  output saying so. Measured end-to-end on a real kernel + SQL driver: three rows across two
+  member orgs came back as three interactively and two in the report, and a scheduled CSV
+  digest emailed the owner the same two. `timezone` went the same way, so a read-time
+  formula field resolved its calendar day in UTC instead of the caller's business timezone;
+  `posture`, `org_user_ids`, `systemPermissions` and `onBehalfOf` were dropped too.
+
+  **After.** The read receives the caller's envelope whole (the #6206 ruling — enforcement
+  adjudicates on the whole `resolveAuthzContext` envelope, never a per-site subset), minus
+  the `__`-prefixed keys plugin-security stamps for the operation in flight, and as a fresh
+  object so a callee's stamp cannot write back into the caller's request context. The same
+  shape `plugin-audit` (#7141) and `service-storage` (#7145) landed. Direction is unchanged
+  outside `group`: the `isolated` posture, a deployment with no posture provider, and a
+  `group` caller with an empty accessible set all still read at active-org equality.
+
+- 2c2a212: fix(reports): owner-gate the saved-report schedule routes (#2980)
+
+  The report read/run/delete routes are owner-isolated (a caller may only touch a
+  report they own, denied as `REPORT_NOT_FOUND` to avoid leaking that the id
+  exists), but the two schedule routes bypassed that gate: `unscheduleReport` and
+  `listSchedules` took the caller `context` as `_context` and never consulted it,
+  querying under the system context (RLS-bypassing). Any authenticated caller
+  could therefore delete another owner's report schedule — a cross-owner
+  destructive write — or list another owner's schedules (leaking recipient
+  addresses and cron), by supplying an id.
+
+  Both now resolve the schedule's parent report and require the caller to own it,
+  mirroring the sibling routes:
+
+  - **`unscheduleReport`** loads the schedule, then its report, and deletes only
+    when `canAccessReport` holds; a cross-owner attempt throws `REPORT_NOT_FOUND`
+    (mapped to `404` by the REST layer, deny-as-404 anti-enumeration), while a
+    genuinely-absent schedule stays idempotent. `scheduleReport` (create) was
+    already gated via `getReport`, so only the delete/list doors were open.
+  - **`listSchedules`** returns an empty list to any non-system caller who cannot
+    access the report it is scoped to — the same non-leaking posture as
+    `listReports`. The scheduler's system context still sees every schedule.
+
+  No authoring-surface or metadata change; existing owner-path behavior is
+  unchanged.
+
+- dadd1ad: refactor(spec,plugin-sharing): retire the exported `SharingExecutionContext` type (#7218)
+
+  <!-- adr-0087: registered sharing-execution-context-retired -->
+
+  **BREAKING — public surface removal.** `SharingExecutionContext` is deleted from
+  `@objectstack/spec` (`contracts/sharing-service`) and from
+  `@objectstack/plugin-sharing`, which re-exported it. Both `api-surface/` and
+  `export-origins/` snapshots are regenerated accordingly.
+
+  This is the deferred deletion recorded when #7070 split the convergence in two.
+  #6523 / PR #7068 converged 36 contract signatures onto the full
+  `resolveAuthzContext` envelope (`ExecutionContext`), applying the #6206 ruling —
+  enforcement adjudicates on the whole envelope, never a per-site subset. The
+  consumer halves then re-annotated the implementations: PR #7140 (identity:
+  `plugin-sharing`, `plugin-audit`) and PR #7206 (services: `plugin-approvals`,
+  `plugin-reports`). Both landed with the type still exported, because it is
+  DEFINED in `packages/spec` and that package's retirement is the spec seat's to
+  make. Nothing declares it any more, so it goes.
+
+  **Migration.** Anyone who imported `SharingExecutionContext` from either package
+  should import `ExecutionContext` from `@objectstack/spec` instead — the type the
+  contracts have declared since #7068. The old shape was six optional fields, all
+  of which exist on the envelope with the same names and types, so a value that
+  satisfied the retired type already satisfies `ExecutionContext`; only the
+  spelling of the annotation changes.
+
+  **No runtime behaviour changes.** The type was erased at compile time and no
+  signature's accepted shape moved: the contracts already took the wide envelope.
+
+  **What the retirement did NOT remove — the reason to read the pins.** Deleting
+  the type does not make re-narrowing a compile error. Structural subtyping still
+  accepts a six-field context where the envelope is expected, so the boundary is
+  held by the declared parameter type plus the pins, exactly as before. The three
+  `exec-context-annotation.pin.ts` files (`plugin-sharing`, `plugin-approvals`,
+  `plugin-reports`) told their failure story as "the parameter narrows back to
+  `SharingExecutionContext`", which a deletion would have quietly hollowed out.
+  Each now keeps the retired six-field shape as a local, non-exported SPECIMEN
+  type and refutes every enforcement parameter against it by type identity, so a
+  re-narrowing under ANY name is red — alongside the fresh-literal
+  excess-property checks they already carried. `sharing-service.test.ts` in
+  `packages/spec` is re-anchored the same way, and its "twin unchanged in shape"
+  case becomes a "twin stays retired" case. The narrative the retired type's doc
+  block carried (the measured `(context as any).posture` specimen, and why tsc
+  cannot police this) moves to the module doc of `contracts/sharing-service`,
+  which the contracts and pins now point at.
+
+- 2465133: fix(plugins): sweep the service-lookup erasures out of the plugin composition roots, and fix the two alias-only HTTP reads it exposed (#4251 B5)
+
+  Batch B5 of the #4251 sweep: the seven remaining `packages/plugins/*` composition
+  roots. 35 lookup sites that had been erased to `any` now carry the slot's
+  contract, so the compiler checks what each plugin actually calls on the service
+  it resolved. The ratchet drops 143 sites / 32 files to 108 / 25.
+
+  **Two real defects, both of the shape this sweep exists to find.** Approvals'
+  actionable-link pages (ADR-0043) and sharing's public share-link REST routes each
+  read the HTTP server under `http-server` _only_ — the deprecated alias. The
+  ledger records `http.server` as canonical and as the only name present on every
+  provider path: `runtime.ts`'s `config.server` path registers no alias at all. On
+  that path both lookups threw, the surrounding `catch` swallowed it, and the
+  routes silently never mounted — approval e-mail action links 404'd and the
+  share-link surface was absent, with nothing in the log to say so. Both reads are
+  now canonical-first with the alias as fallback, each name in its own `try`
+  because `getService` throws on an empty slot (so `a() ?? b()` inside one `try`
+  never reaches `b` — the same correction #4393 made in metadata and
+  cloud-connection).
+
+  Typing choices follow the batch method: pure data-plane consumers take the
+  narrow contract (`IDataEngine` in reports), consumers that bind hook or
+  middleware seams take the engine seen whole (`IObjectQLEngine` in approvals,
+  sharing and pinyin-search), and slots with no contract get a **named** local
+  surface rather than `any` — plugin-email's `MailSettingsSurface`, and the
+  surfaces the consuming packages already declared (`ApprovalMessagingSurface`,
+  `SharingSecurityProbe`, `ReportEmail`). A named surface that omits a member
+  still makes the compiler name every call site; `any` says nothing.
+
+  No behaviour change beyond the two alias reads. No contract changes.
+
+- Updated dependencies [3d5c090]
+- Updated dependencies [e5bd768]
+- Updated dependencies [e027b3e]
+- Updated dependencies [c2429b0]
+- Updated dependencies [445a0c2]
+- Updated dependencies [f6609e6]
+- Updated dependencies [a70358a]
+- Updated dependencies [97e7e3c]
+- Updated dependencies [8828b9e]
+- Updated dependencies [53068c1]
+- Updated dependencies [ee58392]
+- Updated dependencies [f16e54e]
+- Updated dependencies [06be54e]
+- Updated dependencies [259459d]
+- Updated dependencies [3f7f14e]
+- Updated dependencies [6968885]
+- Updated dependencies [eaed61f]
+- Updated dependencies [debe2f6]
+- Updated dependencies [97b0798]
+- Updated dependencies [5fa04fb]
+- Updated dependencies [43a7a8d]
+- Updated dependencies [73f69dc]
+- Updated dependencies [04c56aa]
+- Updated dependencies [b3efeb7]
+- Updated dependencies [ddd075a]
+- Updated dependencies [88154be]
+- Updated dependencies [e8dc61e]
+- Updated dependencies [2f3e793]
+- Updated dependencies [d8e8d9c]
+- Updated dependencies [94e749b]
+- Updated dependencies [ea1d916]
+- Updated dependencies [ae31a19]
+- Updated dependencies [e0f300b]
+- Updated dependencies [62b6a2f]
+- Updated dependencies [5b4780b]
+- Updated dependencies [a933452]
+- Updated dependencies [8140915]
+- Updated dependencies [7b48cf9]
+- Updated dependencies [b5404f4]
+- Updated dependencies [f764691]
+- Updated dependencies [e120a5a]
+- Updated dependencies [e650d67]
+- Updated dependencies [04476e7]
+- Updated dependencies [79228cd]
+- Updated dependencies [b3363e9]
+- Updated dependencies [2ef1807]
+- Updated dependencies [d03fe25]
+- Updated dependencies [2672f85]
+- Updated dependencies [11066f6]
+- Updated dependencies [916af17]
+- Updated dependencies [84c86fb]
+- Updated dependencies [2a2a9fb]
+- Updated dependencies [a2e157c]
+- Updated dependencies [95c4227]
+- Updated dependencies [2a61116]
+- Updated dependencies [d4df105]
+- Updated dependencies [e2798fa]
+- Updated dependencies [0fd8556]
+- Updated dependencies [74155c7]
+- Updated dependencies [6908830]
+- Updated dependencies [8b06bba]
+- Updated dependencies [4c54037]
+- Updated dependencies [0f7157b]
+- Updated dependencies [d9bef45]
+- Updated dependencies [f549a0d]
+- Updated dependencies [82da264]
+- Updated dependencies [f586f1a]
+- Updated dependencies [9b9b70f]
+- Updated dependencies [f5a9bc2]
+- Updated dependencies [881a3cc]
+- Updated dependencies [ad6317b]
+- Updated dependencies [8a88885]
+- Updated dependencies [5f7669e]
+- Updated dependencies [becbe53]
+- Updated dependencies [b127c8b]
+- Updated dependencies [a80302a]
+- Updated dependencies [474f131]
+- Updated dependencies [050cd82]
+- Updated dependencies [4d552af]
+- Updated dependencies [44d677c]
+- Updated dependencies [c32944d]
+- Updated dependencies [1dd780f]
+- Updated dependencies [c8d6f6e]
+- Updated dependencies [92a67f2]
+- Updated dependencies [9136327]
+- Updated dependencies [bf0ae99]
+- Updated dependencies [cb3b6cd]
+- Updated dependencies [73b7234]
+- Updated dependencies [d2b97c3]
+- Updated dependencies [59b794f]
+- Updated dependencies [fc3a36a]
+- Updated dependencies [69787f0]
+- Updated dependencies [5d022a1]
+- Updated dependencies [042b9ee]
+- Updated dependencies [f549a0d]
+- Updated dependencies [a36db28]
+- Updated dependencies [3f8817a]
+- Updated dependencies [a2443e3]
+- Updated dependencies [e1554b1]
+- Updated dependencies [4856789]
+- Updated dependencies [c3f4916]
+- Updated dependencies [33e0385]
+- Updated dependencies [2205363]
+- Updated dependencies [09fe58d]
+- Updated dependencies [d0a5ceb]
+- Updated dependencies [e18a162]
+- Updated dependencies [d6d1a50]
+- Updated dependencies [d127ff0]
+- Updated dependencies [9b86cf6]
+- Updated dependencies [8825a06]
+- Updated dependencies [5087ac6]
+- Updated dependencies [2d1ddf0]
+- Updated dependencies [354b00f]
+- Updated dependencies [3de535b]
+- Updated dependencies [fe2e15a]
+- Updated dependencies [c6b6bb4]
+- Updated dependencies [59c544d]
+- Updated dependencies [2f59da0]
+- Updated dependencies [8ad609c]
+- Updated dependencies [bbee302]
+- Updated dependencies [08863dd]
+- Updated dependencies [56664f5]
+- Updated dependencies [31cbe90]
+- Updated dependencies [90bbf25]
+- Updated dependencies [eb91eba]
+- Updated dependencies [42da73d]
+- Updated dependencies [643b7c7]
+- Updated dependencies [d0d5205]
+- Updated dependencies [1a15893]
+- Updated dependencies [b70e534]
+- Updated dependencies [2233a85]
+- Updated dependencies [62dd69a]
+- Updated dependencies [e15e679]
+- Updated dependencies [2ab1257]
+- Updated dependencies [4cc4fb7]
+- Updated dependencies [28d1eb7]
+- Updated dependencies [2c26040]
+- Updated dependencies [f758cec]
+- Updated dependencies [78f0be8]
+- Updated dependencies [35f7fb4]
+- Updated dependencies [a5302c7]
+- Updated dependencies [7084313]
+- Updated dependencies [0e043d8]
+- Updated dependencies [dadd1ad]
+- Updated dependencies [2f2e63c]
+- Updated dependencies [486d526]
+- Updated dependencies [89d7b35]
+- Updated dependencies [85ec26d]
+- Updated dependencies [f6476fc]
+- Updated dependencies [4ac12ef]
+- Updated dependencies [b88f5e8]
+- Updated dependencies [42cc219]
+- Updated dependencies [d42a92f]
+- Updated dependencies [51d74ad]
+- Updated dependencies [d7e0b42]
+- Updated dependencies [3510e4a]
+- Updated dependencies [aa4b90d]
+- Updated dependencies [54299ca]
+- Updated dependencies [dc61def]
+- Updated dependencies [251e888]
+- Updated dependencies [183b4c4]
+- Updated dependencies [2fdb36e]
+- Updated dependencies [e787608]
+- Updated dependencies [20526f5]
+- Updated dependencies [c5eef1d]
+- Updated dependencies [e0f300b]
+- Updated dependencies [761a0ba]
+- Updated dependencies [61282f9]
+- Updated dependencies [be87153]
+- Updated dependencies [60f0dd8]
+- Updated dependencies [a87c5cd]
+- Updated dependencies [a47f338]
+- Updated dependencies [2598216]
+- Updated dependencies [2c7e62d]
+- Updated dependencies [eb7613c]
+- Updated dependencies [ecc9110]
+- Updated dependencies [f7bd4e2]
+- Updated dependencies [361bd5b]
+- Updated dependencies [1818998]
+- Updated dependencies [09ee21c]
+- Updated dependencies [f549a0d]
+- Updated dependencies [3fc2e48]
+- Updated dependencies [e8f435c]
+- Updated dependencies [41610f6]
+  - @objectstack/spec@17.0.0-rc.6
+  - @objectstack/platform-objects@17.0.0-rc.6
+  - @objectstack/core@17.0.0-rc.6
+
 ## 17.0.0-rc.5
 
 ### Patch Changes

package/dist/index.d.mts

@@ -1,6 +1,7 @@
 export { SysReportSchedule, SysSavedReport } from '@objectstack/platform-objects/audit';
-import { IReportService, SharingExecutionContext, SaveReportInput, SavedReport, ReportRunResult, ScheduleReportInput, ReportSchedule, ReportFormat } from '@objectstack/spec/contracts';
+import { IReportService, SaveReportInput, SavedReport, ReportRunResult, ScheduleReportInput, ReportSchedule, ReportFormat } from '@objectstack/spec/contracts';
 export { IReportService, ReportFormat, ReportQuery, ReportRunResult, ReportSchedule, SaveReportInput, SavedReport, ScheduleReportInput } from '@objectstack/spec/contracts';
+import { ExecutionContext } from '@objectstack/spec/kernel';
 import { Plugin, PluginContext } from '@objectstack/core';
 
 /**
@@ -40,6 +41,26 @@ interface ReportClock {
     now(): Date;
 }
 declare function renderReport(rows: any[], format: ReportFormat, fields?: string[]): string;
+/**
+ * Why this module strips the operation-private keys before forwarding an
+ * envelope — the LOCAL half of the argument.
+ *
+ * A report read asks about `report.object_name`, which is not necessarily the
+ * object the caller's envelope last carried a `__`-prefixed depth for: a REST
+ * request that touched another object before reaching `/reports/:id/run` hands
+ * over an envelope plugin-security's middleware has already written into, and
+ * that middleware only OVERWRITES `__readScope` when it resolves permission sets
+ * for the new object (`if (permissionSets.length > 0)`). A stale depth therefore
+ * survives into a question it was never resolved for.
+ *
+ * [#7204] The general rule — which keys those are, why they are dropped by
+ * PREFIX rather than by a name list, and why the copy is load-bearing in both
+ * directions — is `withoutOperationPrivateKeys` in `@objectstack/core`. It was
+ * hand-copied into this file, `plugin-audit`'s comment kit and
+ * `service-storage`'s attachment kit before #7284 gave it one owner; ⛔ import
+ * it, never re-derive it locally (`operation-private-keys.pin.test.ts` catches
+ * the fourth copy).
+ */
 /**
  * Resolves a saved report's owner (`owner_id`) into a real, RLS-bearing
  * `ExecutionContext` so a **scheduled** report executes under the owner's
@@ -50,7 +71,7 @@ declare function renderReport(rows: any[], format: ReportFormat, fields?: string
  * resolver is the reports-surface consumer of ADR-0073's user-less identity
  * resolution.
  */
-type OwnerContextResolver = (ownerId: string) => Promise<SharingExecutionContext | null>;
+type OwnerContextResolver = (ownerId: string) => Promise<ExecutionContext | null>;
 interface ReportServiceOptions {
     engine: ReportEngine;
     email?: ReportEmail;
@@ -125,21 +146,23 @@ declare class ReportService implements IReportService {
     private canAccessReport;
     /** Raw metadata read of a saved report by id (no authz — callers gate). */
     private loadReportRow;
-    saveReport(input: SaveReportInput, context: SharingExecutionContext): Promise<SavedReport>;
+    /** Raw metadata read of a report schedule by id (no authz — callers gate). */
+    private loadScheduleRow;
+    saveReport(input: SaveReportInput, context: ExecutionContext): Promise<SavedReport>;
     listReports(filter: {
         object?: string;
         ownerId?: string;
-    } | undefined, context: SharingExecutionContext): Promise<SavedReport[]>;
-    getReport(reportId: string, context: SharingExecutionContext): Promise<SavedReport | null>;
-    deleteReport(reportId: string, context: SharingExecutionContext): Promise<void>;
-    run(reportId: string, context: SharingExecutionContext): Promise<ReportRunResult>;
-    runAdHoc(input: SaveReportInput, context: SharingExecutionContext): Promise<ReportRunResult>;
+    } | undefined, context: ExecutionContext): Promise<SavedReport[]>;
+    getReport(reportId: string, context: ExecutionContext): Promise<SavedReport | null>;
+    deleteReport(reportId: string, context: ExecutionContext): Promise<void>;
+    run(reportId: string, context: ExecutionContext): Promise<ReportRunResult>;
+    runAdHoc(input: SaveReportInput, context: ExecutionContext): Promise<ReportRunResult>;
     private executeReport;
-    scheduleReport(input: ScheduleReportInput, context: SharingExecutionContext): Promise<ReportSchedule>;
-    unscheduleReport(scheduleId: string, _context: SharingExecutionContext): Promise<void>;
+    scheduleReport(input: ScheduleReportInput, context: ExecutionContext): Promise<ReportSchedule>;
+    unscheduleReport(scheduleId: string, context: ExecutionContext): Promise<void>;
     listSchedules(filter: {
         reportId?: string;
-    } | undefined, _context: SharingExecutionContext): Promise<ReportSchedule[]>;
+    } | undefined, context: ExecutionContext): Promise<ReportSchedule[]>;
     dispatchDue(now?: Date): Promise<{
         fired: number;
         failed: number;

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { SysReportSchedule, SysSavedReport } from '@objectstack/platform-objects/audit';
-import { IReportService, SharingExecutionContext, SaveReportInput, SavedReport, ReportRunResult, ScheduleReportInput, ReportSchedule, ReportFormat } from '@objectstack/spec/contracts';
+import { IReportService, SaveReportInput, SavedReport, ReportRunResult, ScheduleReportInput, ReportSchedule, ReportFormat } from '@objectstack/spec/contracts';
 export { IReportService, ReportFormat, ReportQuery, ReportRunResult, ReportSchedule, SaveReportInput, SavedReport, ScheduleReportInput } from '@objectstack/spec/contracts';
+import { ExecutionContext } from '@objectstack/spec/kernel';
 import { Plugin, PluginContext } from '@objectstack/core';
 
 /**
@@ -40,6 +41,26 @@ interface ReportClock {
     now(): Date;
 }
 declare function renderReport(rows: any[], format: ReportFormat, fields?: string[]): string;
+/**
+ * Why this module strips the operation-private keys before forwarding an
+ * envelope — the LOCAL half of the argument.
+ *
+ * A report read asks about `report.object_name`, which is not necessarily the
+ * object the caller's envelope last carried a `__`-prefixed depth for: a REST
+ * request that touched another object before reaching `/reports/:id/run` hands
+ * over an envelope plugin-security's middleware has already written into, and
+ * that middleware only OVERWRITES `__readScope` when it resolves permission sets
+ * for the new object (`if (permissionSets.length > 0)`). A stale depth therefore
+ * survives into a question it was never resolved for.
+ *
+ * [#7204] The general rule — which keys those are, why they are dropped by
+ * PREFIX rather than by a name list, and why the copy is load-bearing in both
+ * directions — is `withoutOperationPrivateKeys` in `@objectstack/core`. It was
+ * hand-copied into this file, `plugin-audit`'s comment kit and
+ * `service-storage`'s attachment kit before #7284 gave it one owner; ⛔ import
+ * it, never re-derive it locally (`operation-private-keys.pin.test.ts` catches
+ * the fourth copy).
+ */
 /**
  * Resolves a saved report's owner (`owner_id`) into a real, RLS-bearing
  * `ExecutionContext` so a **scheduled** report executes under the owner's
@@ -50,7 +71,7 @@ declare function renderReport(rows: any[], format: ReportFormat, fields?: string
  * resolver is the reports-surface consumer of ADR-0073's user-less identity
  * resolution.
  */
-type OwnerContextResolver = (ownerId: string) => Promise<SharingExecutionContext | null>;
+type OwnerContextResolver = (ownerId: string) => Promise<ExecutionContext | null>;
 interface ReportServiceOptions {
     engine: ReportEngine;
     email?: ReportEmail;
@@ -125,21 +146,23 @@ declare class ReportService implements IReportService {
     private canAccessReport;
     /** Raw metadata read of a saved report by id (no authz — callers gate). */
     private loadReportRow;
-    saveReport(input: SaveReportInput, context: SharingExecutionContext): Promise<SavedReport>;
+    /** Raw metadata read of a report schedule by id (no authz — callers gate). */
+    private loadScheduleRow;
+    saveReport(input: SaveReportInput, context: ExecutionContext): Promise<SavedReport>;
     listReports(filter: {
         object?: string;
         ownerId?: string;
-    } | undefined, context: SharingExecutionContext): Promise<SavedReport[]>;
-    getReport(reportId: string, context: SharingExecutionContext): Promise<SavedReport | null>;
-    deleteReport(reportId: string, context: SharingExecutionContext): Promise<void>;
-    run(reportId: string, context: SharingExecutionContext): Promise<ReportRunResult>;
-    runAdHoc(input: SaveReportInput, context: SharingExecutionContext): Promise<ReportRunResult>;
+    } | undefined, context: ExecutionContext): Promise<SavedReport[]>;
+    getReport(reportId: string, context: ExecutionContext): Promise<SavedReport | null>;
+    deleteReport(reportId: string, context: ExecutionContext): Promise<void>;
+    run(reportId: string, context: ExecutionContext): Promise<ReportRunResult>;
+    runAdHoc(input: SaveReportInput, context: ExecutionContext): Promise<ReportRunResult>;
     private executeReport;
-    scheduleReport(input: ScheduleReportInput, context: SharingExecutionContext): Promise<ReportSchedule>;
-    unscheduleReport(scheduleId: string, _context: SharingExecutionContext): Promise<void>;
+    scheduleReport(input: ScheduleReportInput, context: ExecutionContext): Promise<ReportSchedule>;
+    unscheduleReport(scheduleId: string, context: ExecutionContext): Promise<void>;
     listSchedules(filter: {
         reportId?: string;
-    } | undefined, _context: SharingExecutionContext): Promise<ReportSchedule[]>;
+    } | undefined, context: ExecutionContext): Promise<ReportSchedule[]>;
     dispatchDue(now?: Date): Promise<{
         fired: number;
         failed: number;

package/dist/index.js

@@ -30,6 +30,7 @@ module.exports = __toCommonJS(index_exports);
 var import_audit2 = require("@objectstack/platform-objects/audit");
 
 // src/report-service.ts
+var import_core = require("@objectstack/core");
 var import_croner = require("croner");
 var SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] };
 var DEFAULT_FORMAT = "csv";
@@ -219,6 +220,15 @@ var ReportService = class {
     });
     return Array.isArray(rows) && rows[0] ? rows[0] : null;
   }
+  /** Raw metadata read of a report schedule by id (no authz — callers gate). */
+  async loadScheduleRow(scheduleId) {
+    const rows = await this.engine.find("sys_report_schedule", {
+      where: { id: scheduleId },
+      limit: 1,
+      context: SYSTEM_CTX
+    });
+    return Array.isArray(rows) && rows[0] ? rows[0] : null;
+  }
   // ── Report CRUD ────────────────────────────────────────────────
   async saveReport(input, context) {
     if (!input.name) throw new Error("VALIDATION_FAILED: name is required");
@@ -326,9 +336,35 @@ var ReportService = class {
       // Reports execute with the caller's identity so sharing rules
       // (if installed) apply. Falls back to system bypass only when
       // the report definition was created by a system writer.
+      //
+      // [#7204] The WHOLE envelope, not a rebuilt subset of it — the #6206
+      // ruling (#6523): a read that adjudicates on the caller's identity
+      // adjudicates on the whole `resolveAuthzContext` envelope. The
+      // five-field projection this replaced (`userId` / `tenantId` /
+      // `positions` / `permissions` / `isSystem`) was doing two jobs, and
+      // only one of them was correct:
+      //
+      //  - dropping the middleware-private keys — CORRECT, and preserved
+      //    above by {@link withoutOperationPrivateKeys};
+      //  - dropping the PRINCIPAL fields — the defect. `accessible_org_ids`
+      //    (ADR-0105 D2) is the one that changes rows: `buildDriverOptions`
+      //    reads it BY NAME to widen the driver's native tenant scope to the
+      //    caller's membership union under the `group` posture, and an absent
+      //    set makes drivers "fall back to equality: fail toward isolation".
+      //    So the same query returned the union in an interactive list view
+      //    and collapsed to active-org equality inside a saved or scheduled
+      //    report — silently short rows, no error. `timezone` is read two
+      //    lines up in the same engine method (`hasTz`) and again by
+      //    `applyFormulaPlan` for read-time formula fields, and `posture`,
+      //    `org_user_ids`, `systemPermissions` and `onBehalfOf` went the same
+      //    way; they are forwarded now for the same reason — the envelope is
+      //    the contract's unit.
+      //
+      // The three defaults below are byte-for-byte what the projection
+      // produced for an envelope that omits them, and are kept so this change
+      // adds fields without changing any that were already there.
       context: {
-        userId: context.userId,
-        tenantId: context.tenantId,
+        ...(0, import_core.withoutOperationPrivateKeys)(context),
         positions: context.positions ?? [],
         permissions: context.permissions ?? [],
         isSystem: context.isSystem ?? false
@@ -401,11 +437,21 @@ var ReportService = class {
     await this.engine.insert("sys_report_schedule", row, { context: SYSTEM_CTX });
     return rowFromSchedule(row);
   }
-  async unscheduleReport(scheduleId, _context) {
+  async unscheduleReport(scheduleId, context) {
     if (!scheduleId) throw new Error("VALIDATION_FAILED: scheduleId is required");
+    const schedule = await this.loadScheduleRow(scheduleId);
+    if (!schedule) return;
+    const report = await this.loadReportRow(schedule.report_id);
+    if (!this.canAccessReport(report, context)) {
+      throw new Error(`REPORT_NOT_FOUND: ${scheduleId}`);
+    }
     await this.engine.delete("sys_report_schedule", { where: { id: scheduleId }, context: SYSTEM_CTX });
   }
-  async listSchedules(filter, _context) {
+  async listSchedules(filter, context) {
+    if (!context?.isSystem) {
+      if (!filter?.reportId) return [];
+      if (!await this.getReport(filter.reportId, context)) return [];
+    }
     const f = {};
     if (filter?.reportId) f.report_id = filter.reportId;
     const rows = await this.engine.find("sys_report_schedule", {