fix(reports): owner-gate the saved-report schedule routes (#2980)

[qq9340100]

What

Closes the D1 finding from the platform-checklist sweep (#6557 FOLLOW-UPS.md §1, tracked in #6681): the two saved-report schedule routes were not owner-isolated, while every sibling report route is.

packages/plugins/plugin-reports/src/report-service.ts — unscheduleReport and listSchedules took the caller context as _context and never consulted it, querying under the RLS-bypassing system context. Any authenticated caller could therefore:

• delete another owner's report schedule — a cross-owner destructive write; or
• list another owner's schedules — leaking recipient addresses and cron —

simply by supplying an id. canAccessReport already gates getReport/deleteReport/run/saveReport/listReports (and scheduleReport via getReport), so only the delete/list schedule doors were open.

Fix

Both methods now resolve the schedule's parent report and require the caller to own it, mirroring the sibling routes:

• unscheduleReport loads the schedule, then its report, and deletes only when canAccessReport holds. A cross-owner attempt throws REPORT_NOT_FOUND (deny-as-404, anti-enumeration — never a cross-owner 2xx); a genuinely-absent schedule stays idempotent, matching deleteReport.
• listSchedules returns an empty list to any non-system caller who cannot access the report it is scoped to — the same non-leaking posture as listReports. The scheduler's system context still sees every schedule.
• packages/rest/src/rest-server.ts — the DELETE-schedule route now runs the section's existing handleValidation helper in its catch, so REPORT_NOT_FOUND surfaces as 404 instead of 500 (same mapping the POST-schedule route already uses).

Includes a changeset (@objectstack/plugin-reports + @objectstack/rest, patch). No authoring-surface or metadata change; existing owner-path behavior is unchanged.

Tests

report-service.test.ts gains 5 owner-gate cases — cross-owner delete denied and schedule survives, unknown-id delete idempotent, cross-owner list empty, system-context list still sees schedules. pnpm --filter @objectstack/plugin-reports test → 42 passed.

Note: the full @objectstack/rest test suite (rest.test.ts) could not run in the authoring container because @objectstack/spec's build is independently red on this branch (an ADR-0087 governance guard: 62 schemas left the published set with no registered removal — unrelated to this diff). The REST change is a one-line reuse of a helper already invoked twice in the same function.

Follow-ups (tracked in #6681, not in this PR)

• Once this and feat(qa): AI 可执行的平台功能标准测试清单 — 15 域 178 项 + 能力覆盖 ratchet + CI 门禁 #6557 both land, flip the dashboards.saved-report-ownership known-gap probe from expected-fail to a positive deny-as-404 assertion.
• Scrub the now-fixed exploit detail from feat(qa): AI 可执行的平台功能标准测试清单 — 15 域 178 项 + 能力覆盖 ratchet + CI 门禁 #6557's public text.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01L8aEBrJVxRnA5XVRkeVft9

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 8, 2026 12:33pm

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/plugin-reports, @objectstack/rest.

12 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/ai/connect-mcp.mdx (via @objectstack/rest)
• content/docs/api/client-sdk.mdx (via @objectstack/plugin-reports)
• content/docs/api/error-handling-server.mdx (via @objectstack/rest)
• content/docs/api/index.mdx (via @objectstack/rest)
• content/docs/permissions/authentication.mdx (via @objectstack/rest)
• content/docs/plugins/index.mdx (via @objectstack/rest)
• content/docs/plugins/packages.mdx (via @objectstack/plugin-reports, @objectstack/rest)
• content/docs/protocol/kernel/http-protocol.mdx (via @objectstack/rest)
• content/docs/protocol/kernel/i18n-standard.mdx (via packages/rest)
• content/docs/releases/implementation-status.mdx (via @objectstack/rest)
• content/docs/releases/v12.mdx (via @objectstack/rest)
• content/docs/releases/v17.mdx (via @objectstack/rest)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.