@objectstack/plugin-sharing 9.2.0 → 9.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-sharing",
-  "version": "9.2.0",
+  "version": "9.3.0",
   "license": "Apache-2.0",
   "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.",
   "main": "dist/index.js",
@@ -13,10 +13,10 @@
     }
   },
   "dependencies": {
-    "@objectstack/core": "9.2.0",
-    "@objectstack/objectql": "9.2.0",
-    "@objectstack/platform-objects": "9.2.0",
-    "@objectstack/spec": "9.2.0"
+    "@objectstack/core": "9.3.0",
+    "@objectstack/objectql": "9.3.0",
+    "@objectstack/platform-objects": "9.3.0",
+    "@objectstack/spec": "9.3.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.2",

package/src/share-link-routes.ts

@@ -249,7 +249,7 @@ export function registerShareLinkRoutes(
       const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] } as const;
       const rows = await engine.find('ai_messages', {
         where: { conversation_id: resolved.link.record_id },
-        sort: [{ field: 'created_at', direction: 'asc' }],
+        sort: [{ field: 'created_at', order: 'asc' }],
         limit: 500,
         context: SYSTEM_CTX,
       } as any);

package/src/sharing-rule-service.ts

@@ -149,7 +149,7 @@ export class SharingRuleService implements ISharingRuleService {
     if (orgId) where.organization_id = orgId;
     const rows = await this.engine.find('sys_sharing_rule', {
       filter: where,
-      orderBy: [{ field: 'name', direction: 'asc' }],
+      orderBy: [{ field: 'name', order: 'asc' }],
       limit: 1000,
       context: SYSTEM_CTX,
     });

package/src/sharing-service.test.ts

@@ -42,7 +42,20 @@ function makeFakeEngine(schemas: Record<string, any>) {
     async find(object: string, options?: any) {
       const table = ensure(object);
       const filter = options?.filter ?? options?.where;
-      return table.filter(r => matches(r, filter)).slice(0, options?.limit ?? 1000);
+      let out = table.filter(r => matches(r, filter));
+      if (options?.orderBy?.[0]) {
+        // Canonical SortNode key only (spec/data/query.zod.ts): the real
+        // engine strips an unknown `direction:` key and defaults to asc, so
+        // the mock must too — honoring both keys masks wrong-key sorts.
+        const { field, order } = options.orderBy[0];
+        out = [...out].sort((a, b) => {
+          const av = a[field]; const bv = b[field];
+          if (av === bv) return 0;
+          const cmp = av > bv ? 1 : -1;
+          return order === 'desc' ? -cmp : cmp;
+        });
+      }
+      return out.slice(0, options?.limit ?? 1000);
     },
     async insert(object: string, data: any) {
       const row = { ...data };
@@ -236,6 +249,17 @@ describe('SharingService.grant / listShares / revoke', () => {
     expect(rows.length).toBe(2);
   });
 
+  it('listShares returns the newest grant first', async () => {
+    // Regression: the query sorted with the non-canonical `direction: 'desc'`
+    // key, which SortNode strips — so it sorted ascending (oldest first).
+    engine._tables.sys_record_share = [
+      { id: 'shr_old', object_name: 'account', record_id: 'a1', recipient_id: 'bob', created_at: '2026-01-01T00:00:00Z' },
+      { id: 'shr_new', object_name: 'account', record_id: 'a1', recipient_id: 'carol', created_at: '2026-02-01T00:00:00Z' },
+    ];
+    const rows = await svc.listShares('account', 'a1', { userId: 'admin' });
+    expect(rows.map(r => r.id)).toEqual(['shr_new', 'shr_old']);
+  });
+
   it('revoke removes the row', async () => {
     const r = await svc.grant({ object: 'account', recordId: 'a1', recipientId: 'bob' }, { userId: 'admin' });
     await svc.revoke(r.id, { userId: 'admin' });

package/src/sharing-service.ts

@@ -266,7 +266,7 @@ export class SharingService implements ISharingService {
   ): Promise<RecordShare[]> {
     const rows = await this.engine.find('sys_record_share', {
       filter: { object_name: object, record_id: recordId },
-      orderBy: [{ field: 'created_at', direction: 'desc' }],
+      orderBy: [{ field: 'created_at', order: 'desc' }],
       limit: 500,
       context: SYSTEM_CTX,
     });