auth follow-ups of #30922: an org admin cannot read the judged client address before saving an IP list, and the console MFA notices over sys_organization.require_mfa are inert #31030

Activity

1. objectstack-fleet

   added

   enhancementNew feature or requestNew feature or request

   priority:p2Medium: important, M3Medium: important, M3

   repo:cloudCard routed whole to the cloud PM: needs cloud code, a producer or a fact (cloud owns it to closure)Card routed whole to the cloud PM: needs cloud code, a producer or a fact (cloud owns it to closure)

   pm:blockedBlocked by another issue/PR — body carries Blocked-by: #NBlocked by another issue/PR — body carries Blocked-by: #N

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   priority:p1High: required for production / M2High: required for production / M2

   and removed

   priority:p2Medium: important, M3Medium: important, M3

   on Nov 6, 2026
2. objectstack-fleet commented on Nov 6, 2026

   

   objectstack-fleetBot

   on Nov 6, 2026

   ContributorAuthor

   More actions

   triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

   Path: none

   Triage: audit · p2 → p1 · domain:server · pm:blocked · 2026-11-06T18:58Z

   ⛔ Not a claim.

   • Follow-ups of Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 from PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's contract review: S7 is an org-admin read of the judged client address, gated by setup.write; S6 removes or re-points the inert require_mfa console notices.
   • Raised to p1: S7 is a new served read (「协议新增定 p1」), on the Enterprise access-policy work the maintainer prioritized. Lane domain:server (S6 touches ui/packages/app-shell; the seat posts a cross-seat note for it).
   • Blocked-by: Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922
   • The card's "after objectstack#31013 lands" had no Blocked-by: line; PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 fixes Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922.
   • ⚠️ S7 returns the caller's own judged address only, never another member's.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

   Carried from objectstack#31013's delta contract review 6695328434 (should-fix) · 2026-11-07T00:49Z

   • D1: ip_not_allowed is a new sys_session.revoke_reason value. Add it to the field description's published vocabulary in sys-session.object.ts, which calls itself the only contract a consumer can read.
   • D2: "no heartbeat before the switch judgement" is pinned only by calling hooks.session.update.before. Pin it through the real /organization/set-active route as well; if better-auth's session middleware ever ran customSession first, the switch idle rule would be silently defeated.
4. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

   Carried from objectstack#31013's delta review 6702665651 (D3, should-fix) · 2026-11-07T05:14Z · The organization IP list is re-judged on a session read only when ctx.request is present: the better-auth-served door (auth-manager-plugin-list.ts, whose door comes from readRequestClientAddress()). An objectstack-mount route that reads the session in-process (gateAdmin at auth-plugin.ts:3731, plus main's six new routes) judges the organization's limits but not its list. The deployment list still gates them. Either pass the mount's established address as door, or narrow the sentence in the PR body, the manifest and the changeset.