Repository navigation
auth follow-ups of #30922: an org admin cannot read the judged client address before saving an IP list, and the console MFA notices over sys_organization.require_mfa are inert #31030
Description
repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2
Filing gate: (c) should-fix carried from a contract review of objectstack#31013 (objectstack#30922; review 6692495550, items S6 and S7).
维护者速读
按组织的访问策略上线后有两处收尾：
- 组织管理员保存 IP 白名单前，看不到平台判定的自己的地址，只能从保存被拒的提示里得知。读这个地址的接口目前只给平台管理员开。
- 控制台里围绕旧字段
require_mfa的提示已经不会再出现（字段改成只读了），这些代码该删掉，或者改成提示新的设置。
Expected
- S7:
GET /admin/client-address, or a sibling read, gated bysetup.writein the organization, so an org admin sees the judged address before savingaccess_policyIP ranges. - S6:
ui/packages/app-shell/src/console/organizationMfaNotices.ts(withAppContent.tsx:969and its i18n strings) is removed, or re-pointed ataccess_policy.mfa_required.
Acceptance
- An org admin reads their judged address; a plain member is refused.
- No dead notice code remains.
Serial: after objectstack#31013 lands.
Suggested-grade: p2.
Activity
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p2 → p1 ·
domain:server·pm:blocked· 2026-11-06T18:58Z⛔ Not a claim.
setup.write; S6 removes or re-points the inertrequire_mfaconsole notices.domain:server(S6 touchesui/packages/app-shell; the seat posts a cross-seat note for it).Blocked-by:line; PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 fixes Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922.Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2
Carried from objectstack#31013's delta contract review 6695328434 (should-fix) · 2026-11-07T00:49Z
ip_not_allowedis a newsys_session.revoke_reasonvalue. Add it to the field description's published vocabulary insys-session.object.ts, which calls itself the only contract a consumer can read.hooks.session.update.before. Pin it through the real/organization/set-activeroute as well; if better-auth's session middleware ever rancustomSessionfirst, the switch idle rule would be silently defeated.objectstack-fleet commentedon Nov 7, 2026
repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2
Carried from objectstack#31013's delta review 6702665651 (D3, should-fix) · 2026-11-07T05:14Z · The organization IP list is re-judged on a session read only when
ctx.requestis present: the better-auth-served door (auth-manager-plugin-list.ts, whosedoorcomes fromreadRequestClientAddress()). An objectstack-mount route that reads the session in-process (gateAdminatauth-plugin.ts:3731, plus main's six new routes) judges the organization's limits but not its list. The deployment list still gates them. Either pass the mount's established address asdoor, or narrow the sentence in the PR body, the manifest and the changeset.objectstack-fleet commentedon Nov 7, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: unblock ·
pm:blocked→pm:queue· 2026-11-07T16:16Z⛔ Not a claim.
Blocked-by:target is closed, re-read now: Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 (closed completed 2026-11-07T13:45Z).Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Claim: PM loop round 1 · 2026-11-07T17:19Z · seat 6's pick in the A/B server split (B = the plugin-auth cluster)
Session:
session_01FEkQ5p3T5YWhLjurajudnQAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-em08naWorktree: the card thread's own checkout of
claude/project-thread-em08naDomain:
domain:serverSeat:
domain:server#6File surface:
packages/plugins/plugin-auth/src/(a new org-admin client-address read + route ledger/mount,auth-plugin.tsgateAdmin/ in-process sessiondoorregion, the/organization/set-activepin, + tests);packages/platform-objects/src/identity/sys-session.object.ts(description vocabulary only);ui/packages/app-shell/src/console/organizationMfaNotices.ts,AppContent.tsxnotice call and its i18n strings; docs sentences on the read; root.changeset/. ⛔packages/spec/**,skills/**(stop on breach; explain in the report)Container & model:
M,mode:thread,model: default,effort: xhigh(p1)Clause-②: yes (widening) (a new served read; the console string removal measured and declared by the dev)
Metadata-protocol: none
Responsibility: n/a — not a defect card (should-fixes carried from PR #31013 contract reviews 6692495550 / 6695328434 / 6702665651)
Thread-read: 6709681591
Premise: holds per triage unblock 6709681591 (#30922 closed); D1–D3 are re-checked against
b5696b49by the dev (work-item face) and reported done-or-notSerial constraints cleared: same-seat parallel #30924 (
auth-plugin.tssign-in IP gate region, disjoint function);ui/**: ui seat 1 #30974 in flight, the dev reads its claim surface before touchingAppContent.tsx; second to land mergesorigin/mainonceobjectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Claim amendment · 2026-11-07T17:32Z · claim 6710570984 · the declaration, measured by the dev
Clause-②: yes (narrowing)
Metadata-protocol: none
The claim said
Clause-②: yes (widening). The diff widens (a new served read,GET /api/v1/auth/client-address) and narrows: S6 is removed under the seat's ruling (no reader that a notice would serve), which deletesconsole.organizationMfa.needsTwoFactorandconsole.organizationMfa.nowRequiredfrom all 11 locale bundles of the published@object-ui/i18n. Precedent:.changeset/30206-first-run-checklist.mddeclared the same kind of key removalyes (narrowing). Consequences: the PR title carries!, the full dogfood battery runs on the final head, and aCONTRACT_REVIEW_TIERreview on that head is owed before landing; the seat runs it. Everything else in the claim stands.objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5mEgSFeDT7pQA12if9
os-dev-report
{
"issue": 31030,
"status": "done",
"branch": "claude/project-thread-em08na",
"pr": "#31258",
"session": "session_01FEkQ5mEgSFeDT7pQA12if9",
"premise_still_valid": true,
"summary": "S7: new GET /api/v1/auth/client-address answers { clientAddress, trustProxy } (the address the access_policy.allowed_ip_ranges save judges) to a caller with setup.write in their current organization, resolved via resolveRequestExecutionContext with the settings door's parameter set; 401 UNAUTHENTICATED anonymous, 403 posture code when held, 403 PERMISSION_DENIED for a plain member, 503 SERVICE_UNAVAILABLE on store outage, closed empty query set (400 VALIDATION_ERROR), caller's own address only; ledger row added. D3 done by passing the address (seat ruling; measured the mount has one): a basePath/* middleware runs the request in a better-auth request state carrying AuthManager.resolveClientAddress, and customSession passes it as door when there is no ctx.request, so in-process session reads at objectstack mounts end a session outside the org IP list (ip_not_allowed). D2: set-active pinned through the real route (401, idle_timeout, last_activity_at unchanged; control 200). D1: ip_not_allowed in sys_session.revoke_reason's description and six bundles. S6: access_policy.mfa_required has no reader a form notice would serve, so per the seat ruling organizationMfaNotices.ts, its test, the AppContent call and the two console.organizationMfa keys in all eleven packs are removed. Card assignee not touched; no own claim.",
"tests": "Final head 78ac3b0: pnpm --filter @objectstack/plugin-auth test exit 0, Test Files 236 passed (236), Tests 4199 passed, 10 skipped; ui vitest (i18n tests + AppContent.recordSaveOneToast-27999) exit 0, 99/99 files, 1756 passed, 13 skipped; dogfood org-admin-client-address-read 4/4. On 0a6d22c: plugin-auth typecheck exit 0; platform-objects test exit 0 (119/119 files, 1701 tests), typecheck exit 0; @object-ui/i18n and @object-ui/app-shell type-check exit 0 each (after app-shell^... build); scoped eslint exit 0 (root: no output; ui: 0 errors, 50 warnings on unedited AppContent lines). Red first: new tests against base sources, 12 failed. Ablations (src-resolved relative imports, no dist leg; each restored, git diff HEAD empty): readMountDoor -> undefined, 2 red; middleware bare next(), 3 red; setup.write check disabled, plain-member case red; heartbeat inserted before judgeSessionSwitch, set-active case red (200 not 401). The first heartbeat ablation was a no-op (replacement contained the anchor, count stayed 1); re-run with a non-containing replacement, which landed.",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack on 78ac3b0: 86 commands, each stdin /dev/null, exit captured before any pipe: 86 exit 0 (lock VERDICT command-exit 0). --ran with COMMAND :: exit CODE lines: 86 derived, 86 run, 0 NOT-MEASURED (a DERIVED zero). Earlier head (78 commands) reds fixed before that run: check:engine-double-contract (ledger --write), check:test-source-alias (static core import; @objectstack/lint warmed in the edited AppContent test), check-plugin-teardown-shape --self-test exit 3 (pinned fixture commit fetched), check:dual-build-cjs-loads exit 3 (closure built). CI check-runs on PR #31258: in_progress at report time; the seat reads them.",
"dogfood_battery": "78ac3b00 · os-verify-lock: VERDICT command-exit 0 · Test Files 436 passed, 3 skipped (439) · Tests 3613 passed, 41 skipped (3654) · no failures",
"mcp_calls": "9 — all reads, no write tool: 7 issue_read / pull_request_read calls reading card #31030 with its comments and PR #31013 with its contract reviews, then issue_read #30974 (the ui in-flight check) and pull_request_read #31258 (body read-back)",
"api_writes": "2 — relay pr_create (fleet-write run 42409560216, PR #31258, body read back 12651 bytes identical, assignees none, no labels: the order names none and a changeset ships); this os-dev-report comment via post-stamped.mjs. Also 6 git pushes (not REST).",
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"flaky test (not a filed class): organization-access-policy.test.ts 'the absolute limit is judged too' creates the session exactly 60 min old against a strict > one-hour limit (auth-manager.ts absoluteHours check), so any elapsed ms flips admitted to ended; red once in a loaded full run, green alone · carrier: #31175 (holds that file) · noted, not filed",
"consumer gap (not a filed class): the console Access policy page does not read GET /api/v1/auth/client-address yet · Seam: runtime auth-plugin.ts client-address route -> renderer SettingsView access_policy namespace, consumer: none · carrier: none · in Acceptance notes",
"docs gap (not a filed class): content/docs teaches no per-organization access policy (only the deployment allowed_ip_ranges) · carrier: none · in Acceptance notes"
],
"deviations": [
"D2/D3 pins live in a new file organization-access-policy-doors.test.ts rather than organization-access-policy.test.ts, because #31175 is in flight on that file",
"pr_create sent no labels key: the relay refuses an empty labels list and the order names none",
"Merged origin/main once (78ac3b0) after #31194 touched plugin-auth; one conflict in de-quote-pairing-3876.test.ts counts (110 on main, 109 with this removal); pnpm install re-run after the merge for main's new lint workspace dep",
"os-dev.md rule 2 says pr_create carries assignees; the order and AGENTS.md say none; followed the order (none)",
"Before editing ui/**: read #30974 (ui seat 1, in flight, PR #31202): Studio OWD files only, no AppContent or notices; it has since landed"
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5mEgSFeDT7pQA12if9
Timing measurement for PR #31258 (merge-queue removals on 5 s test timeouts). Measured on PR head
fe4a9653merged locally withorigin/main59d9815a(merge248b9670, not pushed). The A side is the same tree withpackages/plugins/plugin-authandpackages/platform-objectschecked out fromorigin/mainand rebuilt. Everything else this PR changes (ui packs, the dogfood test, scripts, the changeset) is outside both test files' runtime closure. Each file was run 5 times per side, under the verify lock, withvitest run FILE --reporter=json. Every run exited 0.examples/app-todo/test/loop-body-iteration.test.ts, "ESCALATION … real day count"packages/qa/scenarios/test/runner/external-driver.test.ts, "a full crm run through the command …"The head is not slower: every median is within noise of main's.
Why the mount-door read cannot reach these cases:
FakeAppintest/export/fixture.ts). It boots no stack and imports nothing from@objectstack/plugin-auth.@objectstack/plugin-auth/rate-limit-storagesubpath fromnotify-node.ts, which this PR does not touch./api/v1/auth/*. Per request it adds one header read and one request-state frame. InenforceSessionControlsthe address is judged, with its extra read, only when the session's organization has a non-empty Allowed IP ranges list (judgesAddress). With no list, the code path and the query count are unchanged.A case that takes about 0.34 s locally and timed out at 5015 ms in the queue points to shard load rather than this diff. No fix is pushed. The PR head stays
fe4a9653.Generated by Claude Code
objectstack-fleet commentedon Nov 8, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
落地 · 2026-11-08T02:32Z
f5e23e2f(ACCEPT 6713466889 onfe4a9653, contract review 6712531628 carried by Regen-provenance)Fixes #31030loop-body-iterationtimeouts (anchor #31294, fixed by PR #31312 for #31298); measured no slowdown (6714482295)State change:
pm:dispatchedremoved; nothing left on this card. #31259 (seat 5) was waiting on this merge and is now unblocked.