Share Permissions not being observed

[StewartLynch]

I am able to share with another CloudKit user, but when the user accepts the share, they are getting readWrite access regardless of whether or not I have set the access to View only.

That test user is still able to edit and the share.currentUserParticipant
If I access the share object, this is what I see:

<CKShare: 0x112374200; recordType=cloudkit.share, recordID=share-00000000-0000-0000-0000-000000000001:properties:(co.pointfree.SQLiteData.defaultZone:_70c5362297c5eedd9d7100add0872b60), recordChangeTag=gb, mutableEncryptedPSK=<CKEncryptedData: 0x1122f2d20; length=39>, routingKey=01e, rootRecordID=<null>, etag=gb, publicPermission=none, participantVisibility=Default, participantSelfRemovalBehavior=Default, routingKey=01e, mutableEncryptedPSK=<CKEncryptedData: 0x1122f2d20; length=39>, participants=(
    "<CKShareParticipant: 0x11223d400; participantID=DE205674-DAFF-4C6D-BDF9-EA6BB19BCB23, shareID=share-00000000-0000-0000-0000-000000000001:properties:(co.pointfree.SQLiteData.defaultZone:_70c5362297c5eedd9d7100add0872b60), isCurrentUser=false, role=owner, permission=readWrite, acceptanceStatus=Accepted, identity=<CKUserIdentity: 0x112204a20; userID=_70c5362297c5eedd9d7100add0872b60:(_defaultZone:__defaultOwner__), nameComponents=, lookupInfo=<CKUserIdentityLookupInfo: 0x112302310;>, cached=false, publicKeyVersion=1, publicSharingKey=<null>, hasiCloudAccount=true>, invitationTokenStatus=Healthy, isAnonymousInvitedParticipant=false, isApprovedRequester=false, originalParticipantRole=owner>",
    "<CKShareParticipant: 0x11223d540; participantID=4130D4DD-DB57-4444-A179-2C46629CA141, shareID=share-00000000-0000-0000-0000-000000000001:properties:(co.pointfree.SQLiteData.defaultZone:_70c5362297c5eedd9d7100add0872b60), isCurrentUser=true, role=user, permission=readOnly, acceptanceStatus=Accepted, identity=<CKUserIdentity: 0x112205020; userID=__defaultOwner__:(_defaultZone:__defaultOwner__), nameComponents=CreaTECH, lookupInfo=<CKUserIdentityLookupInfo: 0x112302220; emailAddress=createchtester@gmail.com>, cached=false, publicKeyVersion=2, publicSharingKey={ length=137, sha256=28524fb1bd7cc1cb25809a6e3ae86f16ec36bd047cc6863e22043919ca5ce16b }, hasiCloudAccount=true>, hasProtectionInfo=true, invitationTokenStatus=Healthy, isAnonymousInvitedParticipant=false, isApprovedRequester=false, invitationDate=2026-01-03 20:01:05 +0000, acceptanceDate=2026-01-03 20:01:37 +0000, originalParticipantRole=user>"
), accessRequestsEnabled=false, currentParticipant=<CKShareParticipant: 0x11223d540; participantID=4130D4DD-DB57-4444-A179-2C46629CA141, shareID=share-00000000-0000-0000-0000-000000000001:properties:(co.pointfree.SQLiteData.defaultZone:_70c5362297c5eedd9d7100add0872b60), isCurrentUser=true, role=user, permission=readOnly, acceptanceStatus=Accepted, identity=<CKUserIdentity: 0x112205020; userID=__defaultOwner__:(_defaultZone:__defaultOwner__), nameComponents=CreaTECH, lookupInfo=<CKUserIdentityLookupInfo: 0x112302220; emailAddress=createchtester@gmail.com>, cached=false, publicKeyVersion=2, publicSharingKey={ length=137, sha256=28524fb1bd7cc1cb25809a6e3ae86f16ec36bd047cc6863e22043919ca5ce16b }, hasiCloudAccount=true>, hasProtectionInfo=true, invitationTokenStatus=Healthy, isAnonymousInvitedParticipant=false, isApprovedRequester=false, invitationDate=2026-01-03 20:01:05 +0000, acceptanceDate=2026-01-03 20:01:37 +0000, originalParticipantRole=user>>
{
	READ-ONLY
	creatorUserRecordID -> <CKRecordID: 0x1122f2ce0; recordName=_70c5362297c5eedd9d7100add0872b60, zoneID=_defaultZone:__defaultOwner__>
	lastModifiedUserRecordID -> <CKRecordID: 0x1122f2d00; recordName=_70c5362297c5eedd9d7100add0872b60, zoneID=_defaultZone:__defaultOwner__>
	creationDate -> 2026-01-03 20:00:32 +0000
	modificationDate -> 2026-01-03 21:13:14 +0000
	modifiedByDevice -> Stewart’s iPhone 16 Pro
}

Is this not indicating that this user has Read-Only access to the share? I can still make updates and those updates are immediately synchronized to the owner of the share.

[mbrandonw]

Hi @StewartLynch, sorry but I don't have much to say about this one. As far as I can tell this would be a bug on iCloud's part if the share is truly read-only and iCloud is allowing the non-owner to make edits. This is also not the behavior I have observed in the past (and in fact we show read-only sharing in our episodes and it seemed to work fine there).

I will load up one of our demos sometime soon and test this again to see if I can reproduce, but I'm not sure there is much we can do in the library, unless we have fundamentally misunderstood something about CloudKit's APIs (though regardless it seems that your screenshot is showing read-only access and edits are still allowed, which seems like an iCloud bug).

[StewartLynch]

The share is for a property and that property has many rooms and each room has many items.
The permission is read only for the property and I can verify that, but I have no problem editing any of the properties on one of the rooms.

[mbrandonw]

Hi @StewartLynch, we are not able to reproduce this. We just tested an app with a Parent < Child record hierarchy, and I shared a parent record with Stephen with view-only permissions, and he was not able to create a child record or edit an existing one.

I'm not sure what could be causing the behavior you are seeing, but in order for us to investigate we would need a project that demonstrates the problem. And if you are indeed seeing this strange problem, I hope you agree that this would just be a bug in iCloud and should be reported to Apple. We do not enforce permissions in SQLiteData. That is all handled by CloudKit.

Perhaps you can also create a video that demonstrates the problem. We would need to see two devices running so that the view-only device creates a record that is sync'd to the owner of the record.

[StewartLynch]

This is very strange, but I can no longer reproduce the issue. I apologize for the false alarm, but seriously, I was seeing that behaviour, but I can no longer reproduce it. Everything is now working as designed.