Ok, I think I have an idea what's going on, though I'm still not sure of the root cause.
I found that if I change the access_id during an action (like the edit action of the entity in question), it works fine. But if I change the access_id in a view, or change it when the action is invoked via AJAX, it doesn't work.
I could see why Elgg wouldn't allow access_id (or other entity properties) to be modified in views. I'm not sure why calling my action from AJAX seems to have the same issue.
No code, no ideas ¯\_(ツ)_/¯
Hahah, fair enough.
I finally figured this out: I discovered that my entity has a canEdit() function that was returning false under some circumstances. Those circumstances just happened to coincide with when I was attempting to call my actions via AJAX. So the AJAX was a red herring after all.
info@elgg.org
Security issues should be reported to security@elgg.org!
©2014 the Elgg Foundation
Elgg is a registered trademark of Thematic Networks.
Cover image by Raül Utrera is used under Creative Commons license.
Icons by Flaticon and FontAwesome.