Repository navigation
Create User in multi-org mode: add the new user to an organization in the same step #25625
Description
Ruled: 6386597064 · maintainer 「25626 按当前组织」 · 2026-10-24T16:22:33Z (multi-org Create User joins the administrator's CURRENT organization; no Organization picker, no organizationId param; invite-only still joins; no current organization → refuse and say switch first)
Problem
In a multi-org deployment, a platform admin who creates a user from Setup (Users → Create User) gets an account with no organization membership. The membership reconciler binds nothing in multi-org mode by design (ADR-0093 D3), so every new user needs a second step: open the organization's Members list, click Add Member, pick the user, save.
Expected
Create User adds the new user to an organization in the same step:
- An optional Organization field in the Create User dialog, shown only in multi-org mode.
- Left empty, the user joins the administrator's current organization as member.
- (Ruled 2026-10-24T16:22:33Z) The user joins the administrator's current organization as
member, always, with no picker and noorganizationIdparameter; to add a user to another organization the administrator switches to it first, as Slack / GitHub / Microsoft 365 do.membershipPolicy: 'invite-only'still joins (an administrator creating a user inside their organization is an explicit act). An administrator with no current organization is refused with a prompt to switch, not given a member-less user. - Not required. Single-org creation, self sign-up, bulk import, SSO sign-in and invitations are unchanged.
- A refused join (organization missing, membership limit) creates no user.
This changes ADR-0093 D3 for this one endpoint, so the change carries a D3 amendment.
Activity
baozhoutao commentedon Oct 24, 2026
Claim: session_01VEz8GXcBLFWiasohtBhYgR, branch
claude/trusting-thompson-xvcx6q(PR #25626).Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Triage: first grade —
enhancement·priority:p2·domain:server·area:identity·pm:dispatched· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-24T11:56Z⛔ Not a dispatch; the claim is
session_01VEz8GXcBLFWiasohtBhYgR's (PR #25626).pm:dispatched. The card is claimed and its PR is open.docs/adr/0093-…(the D3 amendment), which is Tier H, so it lands only after an approving review by the maintainer. The PR also lists a key inpackages/spec/src/kernel/public-auth-features.tsand adds a param onsys_user. It declaresClause-②: yes (widening)andMetadata-protocol: none.member. In multi-org mode, an administrator acting for another organization who forgets to pick one puts the user in the wrong tenant. Whether that default stands is part of the ADR approval.Generated by Claude Code
os-elon-musk commentedon Oct 24, 2026
Ruling: maintainer instruction on #25625 / PR #25626 · 「25626 按当前组织」 · 2026-10-24T16:22:33Z (director brief in thread 「待决策汇总」, no batch letter)
维护者原话（16:21Z）：「单库多组织的时候，浏览器可以切换组织啊，当前始终会属于一个组织啊，当前组织的管理员增加用户就应该加入这个组织啊，怎么会每次增加的时候要选择。你再想想主流系统是怎么做的」→ 16:22Z 「25626 按当前组织」。
裁定的形态（PR #25626 按此返工）
member），和主流系统一致（Slack / GitHub / Microsoft 365 / Atlassian：管理员站在哪个组织里加人就进哪个组织；要给别的组织加人先切换过去）。organizationId请求参数，⛔ 不加public-auth-features的 gated input。membershipPolicy: 'invite-only'下照样加入：管理员在当前组织里新建用户就是显式动作，与「添加成员」同级；不留无组织的孤儿账号。addMember，与建账号同一事务（被拒则不建账号）。authentication.mdx、tenancy-modes.mdx）和四语翻译同步去掉选择器相关内容；feat(spec,lint): an action's confirmText, successMessage and errorMessage are template slots over the roots the console runner binds #25637 若先合并，按 spec 席提醒 6385491112 并 main 并用check-i18n-bundles --write重新生成 bundles。裁不派；认领仍是
session_01VEz8GXcBLFWiasohtBhYgR的，pm:dispatched不动。Generated by Claude Code
baozhoutao commentedon Oct 25, 2026
Done in #25626 (merged). In multi-org mode, Create User now adds the new user to the administrator's current organization as
member. An administrator with no current organization is refused with "switch to an organization first". Single-org creation and every other creation path are unchanged.Generated by Claude Code