sharing-review

You are reviewing sharing keywords on Apex classes. The platform default for new classes should match platform.sharingDefault from config (typically with sharing). Any deviation must be intentional and justified inline.

Read Project Config First

source "${CLAUDE_PLUGIN_ROOT}/hooks/lib/config.sh"
APEX_SRC="$(sf_config_get '.paths.apexSource' "$ENV")"
SHARING_DEFAULT="$(sf_config_get '.platform.sharingDefault' "$ENV")"
TEST_SUFFIX="$(sf_config_get '.naming.apex.testSuffix' "$ENV")"

Input

$ARGUMENTS:

• (empty) — review every class
• <ClassName> — single class
• --ci / --format json|sarif / --out <path>

Steps

1. Walk Apex source

For each .cls:

• Capture the class declaration line: (public|global|private)\s+(virtual\s+)?(?:abstract\s+)?(?:with|without|inherited)\s+sharing\s+class\s+(\w+) (or no sharing keyword at all → defaults to with sharing for top-level classes; see Apex docs)
• Skip test classes unless --include-tests

2. Classify

A "justification comment" is a line within 5 lines above the class declaration matching:

//\s*(?:reason|why|justification):\s*\S+

3. Cross-check usage

For every without sharing class, find callers via grep:

grep -lE "\b<ClassName>\." "${APEX_SRC}"/*.cls "${APEX_SRC}"/*.trigger

Flag a without sharing class only called from with sharing callers — that's safe. Flag with elevated severity any without sharing class called from @AuraEnabled methods (those run as the user; the privilege escalation is the bug).

4. Output

Default Markdown:

# Sharing Review: <project.name>

Sharing default: with sharing
Classes scanned: 47 production
Run at: 2026-04-28T13:15:00Z

## Findings

### Critical (without sharing called from @AuraEnabled) — 1
- `force-app/.../AdminUtils.cls` (`without sharing`) is called from
  `OrderController.createOrder` (@AuraEnabled). This bypasses the user's
  sharing rules at LWC entry. Add an explicit access check or move the
  privileged code behind a server-only entry point. (SHR-WITHOUT-SHARING-AURA-ESCAPE)

### Warning (without sharing without justification) — 2
- `force-app/.../LegacyJob.cls` — declare a justification comment:
    // reason: scheduled job runs as system; needs cross-org visibility
- `force-app/.../OldHelper.cls` — same

### Note (without sharing with justification) — 3
- `force-app/.../IntegrationUser.cls` // reason: integration user has restricted profile; sharing not applicable
- ...

### Note (implicit `with sharing`) — 12
- (consider adding the explicit keyword for clarity)

CI mode: emit findings via SARIF.

5. Exit codes

• 0 — no findings (or only note severity)
• 1 — any warning or error
• 2 — config error

Rules

• Justification comments must be specific. "// reason: legacy" is not enough. Look for either a referenced ticket / ADR or a domain-specific reason
• AuraEnabled escape is the worst case. A without sharing class touched by an @AuraEnabled method bypasses the user's sharing rules — that's almost always wrong. Treat as error
• inherited sharing is fine for utilities. It defers to the calling class and matches the principle of least surprise
• Don't include test classes unless --include-tests
• Don't auto-rewrite. Sharing changes are operational decisions; the user makes them

Consumers

• @security-reviewer reads this skill's findings as part of its review
• /argo:code-review cross-links to this skill when it sees a class touch DML
• ADRs may justify a without sharing choice — /adr linkable from the justification comment