Repository navigation
fix(plugin-auth): every rule that reads an SSO provider's domain list reads each entry the same way #32975
Description
security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw
Filed by the security lane as a follow-up from the contract review of #32669 (record 6839407007, escalation c). Priority and lane are triage's.
Blocked-by: #32669
Why
Three rules read an SSO provider's domain list: the one-provider-per-domain claim rule (sso-provider-lifecycle.ts, providerDomains), the proven-domain account rule #32669 adds, and the SCIM adoption rule (scim-sso-adoption.ts, its domain condition). The first two read each entry as a host in one spelling; the SCIM rule splits on commas, trims, lower-cases and compares raw text. So one stored entry can name a domain under one rule and not under another.
Rule
Every rule that reads a provider's domain list reads each entry through the same parse, so an entry names the same domain everywhere it is judged.
Acceptance
- The SCIM adoption rule reads the list through the shared parse; an entry that the shared parse does not accept names no domain for SCIM either.
- Tests named by the rule: one entry spelling judged identically by the claim rule, the account rule and the SCIM rule; a control for a bare hostname.
Activity
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: first touch + unblocked →
p1·pm:queue· 2026-11-13T02:47Z⛔ Not a claim.
Blocked-by:edge on this card is closed, so the card moves frompm:blockedtopm:queue.Generated by Claude Code
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: regrade p1 → p3 · 2026-11-13T02:51Z
⛔ Not a claim.
filing-gate.md: 「可达面定上界:security标签不抬级;仅最高权限可达且无现用者至多 p3」). Only an organization administrator writes an SSO provider's domain list. The rules disagree only for an entry stored in a non-bare spelling (a URL, a port, mixed case, a comma list), and no such entry is shown in use. feat(plugin-auth): an SSO provider's domain list takes bare hostnames only, refused at register and edit #32960 (p2) refuses non-bare entries at register and edit, which removes almost all of the inputs this card is about.Generated by Claude Code
objectstack-fleet commentedon Nov 13, 2026
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: regrade p3 → p2 under the adopted grading rules (#32997) · 2026-11-13T03:01Z
⛔ Not a claim; the card's claim and state are unchanged.
Generated by Claude Code
triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH
Path: none
Triage: regrade p2 → Who: an org admin, writing the SSO domain list (a rare configuration act). Measured: no, read from code. The impact is a security-adjacent inconsistency between three rules: p1, then one step down for admin-only reach, gives p2. The earlier p3 applied a second "no current user" step, which the maintainer struck (「我们的客户不多」). under the adopted grading rules (#32997) · 2026-11-13T03:01Z
⛔ Not a claim; the card's claim and state are unchanged.
Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:server#5 · os-elon-musk · session_016WV4d1NJYFGVi2FRztyBNo
Claim: server area-lease pilot (#33059), area A1 (auth and identity), dispatched by seat
domain:server#5· p2 · one PR with #32960 (the same provider domain list) · posted at 2026-11-14T14:48ZSession:
session_016WV4d1NJYFGVi2FRztyBNo(area A1 thread)Account:
os-elon-muskBranch:
claude/area-A1-32960Domain:
domain:serverFile surface:
packages/plugins/plugin-auth/src/sso-provider-lifecycle.ts,sso-account-at-proven-domain.ts,scim-sso-adoption.ts, the domain check inauth-manager.ts(assertSsoProviderDomainFree), their tests,content/docs/permissions/sso.mdx, a changeset.chore(changeset): bare SSO domain entries (#32960, #32975)