fix(plugin-auth)!: under local sign-in off, the last identity provider is the last way in; the direct sign-in door keeps ?redirect= - #33623

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 13 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/authentication.mdx (via callbackURL (literal, a string literal in runDirectSignIn), phone_number (literal, a string literal in otherSignInMethods))
• content/docs/permissions/sso.mdx (via callbackURL (literal, a string literal in runDirectSignIn))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via phone_number (literal, a string literal in otherSignInMethods))
• content/docs/releases/v17/17-5.mdx (via callbackURL (literal, a string literal in runDirectSignIn))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9f8e2fc6d8ac8c79bb110b727cc583c1a5ee23cb && git checkout 9f8e2fc6d8ac8c79bb110b727cc583c1a5ee23cb
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 4c32b9694b7b248646b2053b6eafea2cc212693b 4cf17caabd606319a63ffc071e6061f75361156f && git checkout -B drift-repro 4c32b9694b7b248646b2053b6eafea2cc212693b && git merge --no-ff 4cf17caabd606319a63ffc071e6061f75361156f

node scripts/docs-audit/affected-docs.mjs --json 4c32b9694b7b248646b2053b6eafea2cc212693b

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 4c32b9694b7b248646b2053b6eafea2cc212693b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#5 · os-elon-musk · session_016WV4d1NJYFGVi2FRztyBNo

Request: review · area A1 · Part of #33358 (items 1, 3, 4) · head 2a03b65 · requested at 2026-11-15T03:15Z

Local (os-dev report, #33358 comment 6888421655): plugin-auth full suite 274 files / 5312 passed, 10 skipped; build + typecheck exit 0; eslint exit 0; four ablations red (delete door 2/38, boot report 2/38, errorCallbackURL 1/87, rate-limited landing 1/87); dogfood battery at 2a03b65: 467 files / 3950 passed, 0 failed; derived gates 97: 94 exit 0, 3 NOT MEASURED (check:skill-examples, check:dual-build-cjs-loads, check:type-check-debt: prerequisite builds). Declarations: !, Clause-② yes (narrowing: the last-provider delete is refused under localSignIn: 'off'), BREAKING patch, adr-0087 not-required (no-migration-prescription), Metadata-protocol none. Beyond the claim's file surface: content/docs/permissions/sso.mdx (two paragraphs stating both rules). Env var correction: the card's OS_AUTH_LOCAL_SIGN_IN is OS_AUTH_DIRECT_SIGN_IN_LOCAL_PATH in the code. Remaining on the card: items 2 and 5, and the settings-save half of item 1 (os-dev out-of-scope finding, noted on the card).

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head 2a03b65 · 2026-11-15T03:17Z

review#3.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2a03b651b6bf0df1bb20a4ea831111617662fb7a
Local-runs: none
Scope: .changeset/33358-local-sign-in-off-floor.md, content/docs/permissions/sso.mdx, packages/plugins/plugin-auth/src/direct-sign-in.ts, packages/plugins/plugin-auth/src/direct-sign-in.test.ts, packages/plugins/plugin-auth/src/sign-in-method-floor.ts, packages/plugins/plugin-auth/src/sign-in-method-floor.test.ts

Read: the PR's four commits on top of c32bb6cc (623d63fa, a72de75a, 773e81c7, 2a03b651): 6 files, +295/−22. I compared the floor's predicate with the page's own (ui/packages/auth/src/LoginForm.tsx:349-354), the served value (auth-manager.ts:5928) and the Console's retry logic (ui/apps/console/src/pages/auth/directSignIn.ts:79). I read how better-auth 1.7.12 and @better-auth/sso 1.7.12 add error to errorCallbackURL. I ran no repo test or build. I ran a scratch copy of keptReturnPath and carriedRedirect against the foreign spellings listed below.

① Derived judgments

Items 3 and 4: the carried redirect uses the door's own return-path rule. I found no open redirect.

• Same validator. carriedRedirect (direct-sign-in.ts:221-229) reads redirect from the return path that keptReturnPath already accepted. It then passes that value through keptReturnPath again, the same function the door uses for callbackURL (:187-212). That rule needs one leading /, and rejects //, a backslash, a control character, any of these behind up to three layers of percent-encoding, and a parser-resolved path that starts with //. A scheme such as javascript: fails the leading-/ test.
• Checked again before use. The value is read with URL.searchParams, which decodes it once, and is checked by the rule again at that point. If redirect appears more than once, nothing is carried.
• Encoded, never concatenated. signInPageUrl (:233-238) builds the query with URLSearchParams.set. Both the vendor's errorCallbackURL (:432) and the door's own landing (:412) go through it. The base is host.consolePageUrl('/login'), so the origin is fixed by the server. better-auth adds its error with appendQueryParams (oauth2/errors.mjs, api/routes/callback.mjs, and the SSO plugin's OIDC callback), so an existing ?redirect= keeps a correct & separator.
• No new surface. Anyone can already open /login?redirect=<x> directly. The server only carries a value its stricter rule accepts, and the Console still applies its own handling. A landing that carries error is a hold, so the page does not start again (directSignIn.ts:79). The retry drops only error and error_description.
• Scratch probe (a copy of the two functions, not a repo test). These were all dropped: //evil.example/x, https://evil.example/, /%2F%2Fevil.example, /\evil.example, \\evil.example, /%5cevil, javascript:alert(1), /%09/evil, /..//evil and /%252f%252fevil. A redirect of /apps/crm?view=all came back as redirect=%2Fapps%2Fcrm%3Fview%3Dall.

Item 1: the floor counts what the page draws.

• pageOffersLocalSignIn (sign-in-method-floor.ts:130) is features.localSignIn !== 'off'. The page uses the same test (LoginForm.tsx:349). It hides email and password, phone with a password, and phone OTP under off, whether or not directSignIn is on. The floor reads the same served config (auth-plugin.ts:2335, getPublicConfig()), and localSignIn is served only while the direct sign-in setting is on. So "phone is excluded only under off" is exactly the page's rule. Under hidden, the page still offers both at /login?local=1.
• Too strict? No. The refusal fires only under off, with enterprise SSO on, on the last provider row, and with no social or OIDC provider and no host handoff. In that state, deleting the row leaves the page with nothing to draw. A refused delete locks nobody out, and every way to recover stays open.
• Too loose? No longer. Before this PR, off with phone on passed the delete and the boot report. That is fixed.
• 409 DELETE_RESTRICTED is a standard code (packages/spec/src/api/errors.zod.ts:97; the ledger synonym is in error-code-ledger.test.ts:313). The PR does not add a new code.
• enterpriseSsoLocalOff is in all 11 locales (:284, :304, :326, :352, :373, :394, :418, :444, :469, :494, :518). It is a required field of SignInFloorCopy, so typecheck holds the set.

must-fix M1: under off with email and password switched off, the new refusal and the new boot report give a remedy that does not work, and a pin locks it in.

• The message is chosen by config.emailPassword?.enabled !== false (sign-in-method-floor.ts:763). The boot report is branched the same way (:787). Under off with email and password off, the delete gets enterpriseSso, whose first remedy is "First turn email and password sign-in back on". The boot report gets the original text, which says "no phone-number sign-in" and "Recover: set OS_AUTH_EMAIL_PASSWORD_ENABLED=true and restart" (:799-806).
• Under off, neither remedy helps. Turning email and password on only moves the next attempt to the enterpriseSsoLocalOff refusal. With phone on, "no phone-number sign-in" is false. This PR newly refuses that state (phone on, email and password off, off) and newly reports it. The pin at sign-in-method-floor.test.ts:811-815 asserts the enterpriseSso copy there.
• The PR body gives the reason for the new copy as "turn email and password sign-in back on does nothing there". The same reason applies to this case.
• sso.mdx:722 ("Recover by setting OS_AUTH_DIRECT_SIGN_IN_LOCAL_PATH=hidden") is also not enough in this state.
• Fix:
  • Choose the copy and the report branch by !pageOffersLocalSignIn(config).
  • Give the off texts a remedy that holds in both states. For example: set the local sign-in path back to hidden, and also turn email and password on if it is off. Or add a third variant.
  • Re-pin the phone-only-under-off case and add a boot case for off with email and password off.
  • Word the docs sentence to match.

② Semver level

• Clause-②: yes (narrowing) is right. A delete that returned 200 now returns 409 DELETE_RESTRICTED under off. Two pins hold this, each with its CONTROL (sign-in-method-floor.test.ts:660-685). The title carries !.
• The changeset (:13) has a BREAKING paragraph that names who is affected (direct sign-in with the local path off) and the fix (:17). It has exactly one <!-- adr-0087: not-required (no-migration-prescription) ... --> marker (:11). No stored key or metadata moves, so Metadata-protocol: none and patch are right.
• The redirect change only widens: a landing that was the bare page now carries a value the page already had. It is described in prose under "Also fixed" (:19).

③ Boundary flags

• The diff touches only plugin-auth sources, tests, one changeset and one docs page. It touches no packages/spec, protocol, generated file or release-owned page. sso.mdx is outside the claim's file surface, as declared.
• The dogfood battery is reported green at this head (467 files / 3950 passed). I did not run it.
• Still open on the card: items 2 and 5, and the settings save (signInMethodFloorPredicate, sign-in-method-floor.ts:631), which still counts email and password under off.

Nits (none blocks).

• N1. The changeset's "Widened" list (:7) does not name the new served copy enterpriseSsoLocalOff (11 locales) or the asThePageOffers option of otherSignInMethods. It also calls pageOffersLocalSignIn, pageOffersEmailPassword and carriedRedirect "public functions". They are module exports only: src/index.ts:97 exports just two types from direct-sign-in, and nothing from sign-in-method-floor. Say "module exports", and add the copy key in prose.
• N2. The foreign-redirect pin (direct-sign-in.test.ts:310) loops over 3 spellings. Loop it over FOREIGN_RETURN_PATHS (:56-80) instead, so the backslash, javascript:, control-character and /..// spellings are pinned through carriedRedirect too. Today they hold only because carriedRedirect delegates to keptReturnPath.
• N3. sso.mdx:717-718 says "the checks that keep a way to sign in do not count it under off". The settings save still counts it. Name the two checks this PR changes, and mention phone sign-in too.
• N4. The BREAKING paragraph (:13) does not name phone sign-in. A deployment under off with email and password off and phone on is also newly refused and newly reported. Also, the exits it lists under off (another provider row, a social or OIDC provider, a host handoff) have no pin under off. In the code, asThePageOffers gates only phone, so they hold today.

Implemented-by: claude/area-A1-33358
Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6

VERDICT: FAIL

Contract-review-claim: session_016WV4d1PGptBW3QRQNmy5e6 · head cc741c8 · 2026-11-15T03:35Z

review#3 (delta).

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: cc741c8ef32ceca989c36dbe42bbcad2c74fe798
Local-runs: none
Scope: .changeset/33358-local-sign-in-off-floor.md, content/docs/permissions/sso.mdx, packages/plugins/plugin-auth/src/direct-sign-in.test.ts, packages/plugins/plugin-auth/src/sign-in-method-floor.ts, packages/plugins/plugin-auth/src/sign-in-method-floor.test.ts

This reviews the delta 2a03b651...cc741c8e (one commit, cc741c8e, 5 files, +61/−38) against my FAIL at 2a03b651 (comment 6888499485). I read the diff and the code it relies on at the head: resolveDirectSignIn (direct-sign-in.ts:141-162), keptReturnPath and carriedRedirect (:187-229), pageOffersLocalSignIn and pageOffersEmailPassword (sign-in-method-floor.ts:130-137), and otherSignInMethods (:228-238). I ran no repo test or build. CI at this head was still running when I posted (25 passed, 11 in progress, 2 queued, none failed).

① Derived judgments

M1: closed.

• Selection. The delete copy is now pageOffersLocalSignIn(config) ? enterpriseSso : enterpriseSsoLocalOff (sign-in-method-floor.ts:763). The boot report branches on !pageOffersLocalSignIn(config) (:787). So under off the delete always gets enterpriseSsoLocalOff, and the boot report always gets the local-path text, whatever email and password says.
• The off remedy is true. resolveDirectSignIn reads OS_AUTH_DIRECT_SIGN_IN_LOCAL_PATH before directSignIn.localSignIn (direct-sign-in.ts:147), so =hidden replaces an off set in code. getPublicConfig() then serves localSignIn: 'hidden' (auth-manager.ts:5928), pageOffersLocalSignIn is true, and with email and password on, pageOffersEmailPassword is true. The page offers it at /login?local=1, and both checks stop firing. When email and password is off, the report adds OS_AUTH_EMAIL_PASSWORD_ENABLED=true (:796-798). That is the settings environment override, which wins over the stored value (:71-73), the same remedy the email-off branch already gave. The copy now says "set the local sign-in path back to hidden with email and password sign-in on", which holds in both states.
• The other branch is now true too. It is reached only when the page offers local sign-in and email and password is off. There, asThePageOffers counts phone (:238), so "no phone-number sign-in" is true whenever this text is printed.
• Locales. enterpriseSsoLocalOff changed in all 11 locales (en, zh-Hans, ja, es, zh-Hant, ar, fr, pt, ru, de, ko). I checked zh-Hans ("改回 hidden 并开启邮箱/密码登录"), zh-Hant, ja ("hidden に戻してメール/パスワードログインをオンにして"), es, fr and de. Each one adds "with email and password sign-in on" to the hidden remedy, as the English does, and no other sentence changed.
• Pins. The phone-only-under-off pin now expects enterpriseSsoLocalOff. It also expects the report to name both settings and not to say "no phone-number sign-in" (sign-in-method-floor.test.ts:818-827). A CONTROL with email and password off under hidden keeps enterpriseSso and the OS_AUTH_EMAIL_PASSWORD_ENABLED=true and restart report (:828-833). A real-composition boot under off with email and password off expects one report that names both settings (:694-699). Each assertion matches the strings the code builds.
• Docs. sso.mdx:717-726 now gives the same two-part remedy.

No refuse/allow decision changed. In both ssoProviderDeleteRefusal and resolveNoSignInMethodReport, every line that returns undefined or null is unchanged. The delta changes only which message a refusal or report carries. The decisions the earlier dogfood run covered are the same, so no new dogfood run is owed.

Redirect: still safe. direct-sign-in.ts is not in the delta. carriedRedirect still runs the value through keptReturnPath again, and signInPageUrl still builds the query with URLSearchParams. My earlier reasoning still holds.

N1–N4: addressed.

• N1. The changeset now says "module exports (not on the package entry)". src/index.ts:97 still exports only the two direct-sign-in types. It also names asThePageOffers and the copy key enterpriseSsoLocalOff in 11 locales.
• N2. The pin is now it.each(FOREIGN_RETURN_PATHS), over all 24 spellings (direct-sign-in.test.ts:309).
• N3. sso.mdx now names the two checks, includes phone sign-in, and says the settings save still counts email and password under off.
• N4. The BREAKING paragraph now says "and even with phone sign-in switched on".

Nits (none blocks).

• N5. One of the 24 spellings, /${'a'.repeat(2048)}, makes the whole callbackURL longer than RETURN_PATH_MAX (2048). keptReturnPath then drops the whole page path, so this case never reaches carriedRedirect. The assertion still holds, and the other 23 spellings do go through carriedRedirect.
• N6, carried over from the second half of N4. The exits under off (another provider row, a social or OIDC provider, a host handoff) still have no pin under localSignIn: 'off'. The passes the delete with $name table uses OFF (email and password off, no localSignIn). In the code, asThePageOffers gates only phone, so they hold today.

② Semver level

Unchanged from my earlier record. patch with fix(auth)! and Clause-②: yes (narrowing) is right. The delta changes only refusal and report text, docs and pins. The new copy key existed before the delta, and only its text changed. The BREAKING paragraph and the "What to do" line now give the two-part remedy. There is still exactly one adr-0087: not-required marker. Metadata-protocol: none still holds.

③ Boundary flags

• The delta touches only plugin-auth source and tests, the changeset and sso.mdx. It does not touch packages/spec, any protocol or generated file, or any release-owned page.
• Still open on the card and outside this PR: items 2 and 5, and the settings save (signInMethodFloorPredicate, sign-in-method-floor.ts:631), which still counts email and password under off. sso.mdx now says so.

④ Design judgment

The delta makes the requested fix with the predicate the floor already uses, so the remedy is chosen by the rule the page uses to draw local sign-in. One copy key with a two-part remedy is enough. A third variant would add a locale set without telling the reader anything more. The boot report names the second setting only when it is needed, which keeps the common case short. The CONTROL under hidden makes sure the email-off copy cannot drift into the off text.

Implemented-by: claude/area-A1-33358
Reviewed-by: session_016WV4d1PGptBW3QRQNmy5e6

VERDICT: PASS

Contract review — PASS carries

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4cf17caabd606319a63ffc071e6061f75361156f
Local-runs: none
Scope: .changeset/33358-local-sign-in-off-floor.md, content/docs/permissions/sso.mdx, packages/plugins/plugin-auth/src/direct-sign-in.ts, packages/plugins/plugin-auth/src/direct-sign-in.test.ts, packages/plugins/plugin-auth/src/sign-in-method-floor.ts, packages/plugins/plugin-auth/src/sign-in-method-floor.test.ts

This carries my PASS at cc741c8e (comment 6888701895) to 4cf17caa. The one new commit, 4cf17caa, merges main (c32bb6cc → 4c32b969) into the branch, and the PR adds nothing else.

① Derived judgments

• Only the merge changed. I compared the PR's own diff before the merge (c32bb6cc...cc741c8e) with its diff after it (4c32b969...4cf17caa). Every added and removed line is the same, as is every context line, across all six files. Only the blob ids and the @@ offsets in sso.mdx differ, by +44, because main added text above the PR's hunks. The merge needed no conflict resolution.
• No coupling to what main brought. sso.mdx is the only file both sides touched. On main, plugin-auth changed only the SAML account key (fix(auth)!: a SAML provider keys its accounts on a stable attribute (Entra object id by default), so the app and the IdP portal reach one account #33490: sso-saml-*, sso-sign-in-options.ts, auth-manager.ts, register-sso-provider.ts, objectql-adapter.ts). direct-sign-in.ts imports only the type SsoProviderReader from sso-sign-in-options.ts, and that type did not change. Nothing on main touches sign-in-method-floor.ts, direct-sign-in.ts, the floor predicates or the redirect carry. So every refuse or allow decision, and every message I judged at cc741c8e, is the same at this head.

② Semver level

Unchanged. The changeset is byte-identical: patch, fix(auth)!, Clause-②: yes (narrowing), one adr-0087: not-required marker, Metadata-protocol: none.

③ Boundary flags

Unchanged from 6888701895. Items 2 and 5 and the settings save's floor predicate are still open on the card, outside this PR.

④ Design judgment

Unchanged from 6888701895, since no reviewed line moved. Nits N5 and N6 still stand, and neither blocks.

CI at this head when I posted: 24 passed, 15 skipped, 12 in progress, none failed.

Implemented-by: claude/area-A1-33358
Reviewed-by: session_016WV4czb1FQB8j27FVgnMye

VERDICT: PASS

domain:server#5 · os-elon-musk · session_016WV4d1NJYFGVi2FRztyBNo

ACCEPT · area A1 · Part of #33358 (items 1, 3, 4) · head 4cf17ca · 2026-11-15T04:22Z

• Reviewer: review#3 (session_016WV4d1PGptBW3QRQNmy5e6) FAIL at 2a03b65 (record 6888499485), delta PASS at cc741c8 (record 6888701895): M1 and N1–N4 closed; no refuse/allow decision moved, so no new dogfood run owed.
• Regen-provenance: 2a03b65 → cc741c8 one commit answering M1 (the delete copy and the boot report chosen by !pageOffersLocalSignIn(config); enterpriseSsoLocalOff remedy in 11 locales; pins re-pointed and added) and N1–N4 (changeset wording and copy key, it.each over FOREIGN_RETURN_PATHS, sso.mdx scope, BREAKING names phone sign-in). cc741c8 → 4cf17ca merges origin/main (22 commits; main touched content/docs/permissions/sso.mdx), auto-merged without conflict; the two touched test files 151/151 after the merge.
• Declarations: fix!, Clause-② yes (narrowing), BREAKING patch, adr-0087 not-required (no-migration-prescription), Metadata-protocol none.
• Governed: check-governed-merges.mjs --pr 33623 → NOT governed, 340 changed lines.
• Checks at 4cf17ca: 53 check runs completed, none red (38 success, 15 skipped). Local: plugin-auth full suite 274 files / 5336 passed at cc741c8; typecheck + eslint exit 0; M1 ablations red; dogfood battery 467 files / 3950 passed at 2a03b65 (the last refuse/allow change). plugin-auth is not a shared package under the dependents-before-arming rule.
• Remaining on plugin-auth: with local sign-in off the sign-in floor still counts email and password, and the direct sign-in door's landings lose ?redirect= and the IP allow-list page #33358 after this lands: items 2 and 5 and the settings-save half of item 1 (card scope note).
• Landing: ready + auto-merge (maintainer 2026-11-14 15:21Z).

domain:server#5 · os-elon-musk · session_016WV4cytdN5jRpgKX58AY4d

ACCEPT · area A1 · Part of #33358 (items 1 (the floor), 3, 4) · head 4cf17ca · 2026-11-15T04:23Z

• Reviewer: review#3 (session_016WV4d1PGptBW3QRQNmy5e6) FAIL at 2a03b65 (record 6888499485, must-fix M1: the off remedy text) → delta PASS at cc741c8 (record 6888701895), nits only; PASS carried to 4cf17ca (record 6888853480, PR side line-identical). Clause-② yes (narrowing) upheld: a delete that returned 200 now returns 409 DELETE_RESTRICTED under local sign-in off; title carries !; one adr-0087: not-required marker; Metadata-protocol none; patch.
• Regen-provenance: 2a03b65 → cc741c8 (delta, reviewed) → 4cf17ca = clean merge of origin/main 4c32b96 (main touched content/docs/permissions/sso.mdx only; no conflict). The PR has no generated file. PASS survives a clean main merge (pilot rule).
• Governed: check-governed-merges.mjs --pr 33623 → NOT governed, 0 of 6 paths, 340 changed lines.
• Checks at 4cf17ca: 53 check runs completed, none red (38 success, 15 skipped).
• Main since merge base 4c32b96: 24 commits; none touches the PR's 6 files (plugin-auth overlap is fix(plugin-auth): create-user reports the membership the store holds for the new account #33587's admin-user-endpoints* and test-typecheck-debt.json only). The queue builds on current main.
• Card stays open: item 2 (IP allow-list landing), item 5 (N13 sign-out note) and the settings-save half of item 1 (signInMethodFloorPredicate still counts email and password under off).
• Landing: ready + auto-merge (maintainer 2026-11-14 15:21Z, restated for all areas 2026-11-15 03:57Z).