Repository navigation
plugin-auth test: organization-access-policy.test.ts sets a session exactly 60 minutes old against a one-hour limit and expects admitted, so it goes red whenever a millisecond passes (main red on 56baf78e) #31175
Description
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Filing gate: ① a defect with a named location and a measured red: push CI on main 56baf78e (run 42384924042, Test Core (7/8)). ⛔ Not a claim.
维护者速读
主线 CI 在 56baf78e 上红了一次，红在 plugin-auth 的一个测试上。测试把会话的创建时间设成「正好 60 分钟前」，再断言「1 小时上限还没到」；只要从设时间到判断之间过去哪怕 1 毫秒，会话就超过 60 分钟、被判定结束，测试就红。这是测试写在时间边界上，不是产品回归：产品按上限判定是对的。
Measured
packages/plugins/plugin-auth/src/organization-access-policy.test.tsL398: the fixture row getscreated_at: new Date(Date.now() - 60 * MIN). L420–422:session_absolute_max_hours: 1, comment "60 minutes old against a one-hour limit: not over yet",expect(...judgeSessionSwitch('s1', ORG_A)).toBe('admitted').- Run 42384924042,
Test Core (7/8):AssertionError: expected 'ended' to be 'admitted'at L422. Failed 1 of 4,168 plugin-auth tests. - The test arrived with
b5696b4967(PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013, Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922, landed 2026-11-07).
Expected
- The "not over yet" case sits clearly inside the limit (for example 59 minutes, or a frozen clock with
vi.useFakeTimers/ an injectednow), and the "over" case clearly outside it (61 minutes stays). The assertion keeps proving that the absolute limit is judged at the switch. - Re-read the file's other
minutesAgofixtures (L336–346) for the same boundary pattern.
Acceptance
- The test passes with an artificial delay between fixture and judgment (a fake-timer advance of a few seconds, staying under the limit).
Suggested grade: p1 (a main red, and 「平台测试清单反复变红，肯定要修啊」). Lane domain:server.
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Claim: PM loop round 1 · 2026-11-07T17:18Z · seat 6's pick in the A/B server split (B = the plugin-auth cluster)
Session:
session_01FEkQ5p3T5YWhLjurajudnQAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-wmxpk3Worktree: the card thread's own checkout of
claude/project-thread-wmxpk3Domain:
domain:serverSeat:
domain:server#6File surface:
packages/plugins/plugin-auth/src/organization-access-policy.test.tsonly (and same-file boundary fixtures). ⛔ product source, other test files (named in the report instead) (stop on breach; explain in the report)Container & model:
Smechanical,mode:thread,model: default,effort: mediumClause-②: no
Metadata-protocol: none
Responsibility: test fixture written on the limit boundary by PR #31013 (
b5696b49), objectstack; no product path is wrong; reached by CI only (main red, run 42384924042)Thread-read: none
Premise: holds, read on
origin/mainbd5a443c: L398created_at: new Date(Date.now() - 60 * MIN)againstsession_absolute_max_hours: 1, L421 "not over yet"Serial constraints cleared: none — no open PR or claim touches
organization-access-policy.test.ts; seat-6 siblings #30924 / #31030 / #30959 touch other plugin-auth filesobjectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5mS6HNaJTYsygvmxuM
os-dev-report
{
"issue": 31175,
"status": "done",
"branch": "claude/project-thread-wmxpk3",
"pr": "#31213",
"session": "session_01FEkQ5mS6HNaJTYsygvmxuM",
"premise_still_valid": true,
"summary": "Test-only fix. The deployment() fixture in organization-access-policy.test.ts now creates session s1 59 minutes ago instead of exactly 60, so the 'not over yet' leg sits clearly inside the one-hour absolute limit; the 61-minute 'over' leg (ended, revoke_reason absolute_max) is unchanged and the comment says why the fixture must not sit on the limit. No product file touched. Premise held on origin/main 658d84f (the order's bd5a443 had moved): base fixture red on EVERY local run, not only intermittently. main moved during the work (#30965 SSO landed in plugin-auth), so origin/main 66bf5b4 was merged once (head a51ee30) and the plugin-auth suite and derived gates were re-run there, all green. The PR body quotes the 228d061 readings (gates 51 run + 1 NOT MEASURED, suite 4168); the final-head readings are here (52/52, 4183); the seat may refresh the body, dev does not PATCH.",
"tests": "Acceptance ablation at 228d061 (os-verify-lock, scripts/ablation-replace.mjs, src import so no dist hop), vitest -t 'the absolute limit is judged too': leg0 59min no delay = 1 passed exit 0; leg0b 60min no delay = AssertionError expected 'ended' to be 'admitted' exit 1; leg1 59min + vi.useFakeTimers({toFake:['Date']}); vi.setSystemTime(Date.now()+5_000) = 1 passed exit 0; leg2 60min + same 5s advance = AssertionError expected 'ended' to be 'admitted' exit 1. On-disk counts fixture59/fixture60/delay grep'd per leg; restore proof git diff HEAD empty, disk blob 086c2c08 = HEAD blob. First legs 1/2 attempt was a no-op (replacement contained the anchor, ablation-replace refused 'anchor count moved 1 -> 1' before running), redone with an anchor-rewriting replacement. Delay removed, not in diff. plugin-auth suite: at 228d061 Test Files 234 passed, Tests 4168 passed | 10 skipped, VERDICT command-exit 0; at merged head a51ee30 (closure rebuilt) Test Files 235 passed, Tests 4183 passed | 10 skipped, VERDICT command-exit 0. plugin-auth typecheck (tsc + examples + check:test-typecheck) at 228d061 VERDICT command-exit 0 after building plugin-auth itself (first run exit 2: examples/basic-usage.ts needs its own dist in a fresh worktree).",
"gates": "Derived (dispatch-gates --commands --repo objectstack-ai/objectstack, 52 commands, same list at both heads). At a51ee30 (final head): 52 run, all exit 0; --ran: '52 derived famil(ies) accounted for — 52 run, 0 NOT-MEASURED', exit 0. At 228d061: 51 exit 0, check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET (NOT MEASURED), check-plugin-teardown-shape --self-test exit 3 on shallow clone then exit 0 after git fetch --depth=1 origin 621a487. eslint --no-inline-config packages/plugins/plugin-auth exit 0 (package has no lint script). skip-changeset: plugin-auth files[] = dist, README.md, CHANGELOG.md; after build 0 hits for the new comment text and test file name, positive control judgeSessionSwitch 4 hits in dist. PR check-runs at a51ee30: Test Core (1/8..8/8) success, Test Core success, Type Check · workspace success, Type Check · source/consumer gates + debt ledger success, Lint · ESLint success, Lint · repo & tooling gates success, Lint · CI, release & engine gates success, Lint · PM dispatch-gates success, Lint & Repo Gates success, TypeScript Type Check success, Build Core success, PR-body guards success, Governed Surface Queue Guard success, Check PR Size success, Check Changeset skipped (skip-changeset), UI/Dogfood shards skipped by selector, Dogfood Regression Gate success.",
"dogfood_battery": "n/a — no
!in the PR title and no (narrowing) arm","mcp_calls": "7 — reads only: issue_read x5 (get 1, get_comments 4), pull_request_read x2 (get 1, get_check_runs 1); no MCP write",
"api_writes": "2 — relay pr_create (fw-20261107T175722Z-32b16b, run 42398835124, PR #31213 draft with label skip-changeset, no assignees, body read back identical 7148 bytes); relay comment via post-stamped (this os-dev-report on #31175). Plus git push x2 (not REST): 228d061, then the one origin/main merge a51ee30 the order allows when landing second.",
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"none — swept every Date.now() - N fixture in plugin-auth/src/**/*.test.ts against the limit it meets; none equals its limit (closest: auth-manager.test.ts L4997 60 min created vs a 15-min idle limit and absolute default 0; session-of-record.test.ts L313/L332 12h/2h vs an 8h cap; auth-manager.mcp-oauth.test.ts L359/L546 consent stamps with no limit judged). Same-file minutesAgo cases (L336-346 helper) judge count caps only; L291 hourAgo vs a 5-min idle limit is far over."
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
落地 · 2026-11-07T19:09Z
df22adc3Fixes #31175State change:
pm:dispatchedremoved; nothing left on this card.