Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Host-injected auth context loses user.role/organization in child dev:ssr stacks — role/org-gated plugin RPCs 403 (seeded-session suites red through rc.17)

Abierto
  • ¿Algo no está bien?
#531 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
authentication, backend-api-design, devops

Línea de trabajo

Start by tracing the host's per-request auth-context injection from the resolved session into child plugin oRPC procedures, then compare the injected role and organization fields with the get-session response and the role-gated getDiscoveryStudio failure. The issue also asks for a design decision on pinning the dev host slot or providing a local-host runner. Done means child dev:ssr stacks receive the session's role and organization context, and a host-pinning approach is defined; no relevant source files or tests are named.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

Summary

Follow-up to #527 (closed by the rc.16 null-session fix — that cleared the 307 wall; authed routes now render in child dev:ssr stacks). The remaining half is still red: the host resolves the session but injects a request context without user.role / organization into the child plugins' oRPC procedures. Every role/org-gated procedure 403s, so every seeded-session browser test times out at ~15s. Still reproduces against the rc.17-pinned host (parent republished bos.config.json 2026-10-21 15:47 UTC; host pin manifest gitSha 553a9b2 = the v2.0.0-rc.17 release commit).

Evidence (citynode.app child, extends: bos://dev.everything.near/everything.dev)

  1. The session is valid and fully resolvable — get-session via curl returns the full session with role: "admin" (see #527 repro; still true post-rc.16).
  2. Authed pages render and the client fires data calls — so the 307 wall is gone. But the server-injected context disagrees with the session:
    • POST /api/rpc/getDiscoveryStudio → 403 (Forbidden / Code: FORBIDDEN). The child handler is requireCurator(context): a missing user fails UNAUTHORIZED; a resolved user without admin/curator fails FORBIDDEN. We observe FORBIDDEN — a user was injected, but not as admin.
    • getDiscoveryStudio is called from the shell layout (use-shell-nav) on every authed page — the client session says admin, the injected context says otherwise.
    • Org-gated procedures (requireTenantOwnedByOrg, authorizeNodeAccess) fail the same way; org-switcher specs (need organization.activeOrganizationId) all fail.
    • Result: every seeded-cookie spec fails; every signed-out spec passes. Local run 2026-10-21 16:21 UTC (everything-dev rc.17 + the rc.17-pinned host): 55 ✘ / 3 ✓.
  3. Timeline (child CI on main):
    • Green 2026-10-19 (run 39255126057) against the then-current parent host.
    • The parent redeployed the host between Oct 19–20. First-red run 39509211093 (2026-10-20 22:35 UTC) shows the skew phase: [SharedIdentity] Refusing to load plugin "@everything-dev/auth-plugin": shared dependency version skew. every-plugin: expected 3.0.0-rc.9 (from this runtime), got 3.0.0-rc.6 → "Serving without the API: all /api/* routes return 503" (fast total failure).
    • After the child upgraded (rc.14 → rc.15 → rc.17; every-plugin rc.9/rc.10), plugins load again — but the auth-context failure persists through rc.17. So the regression was introduced host-side with the rc.13-era host and is not covered by the #527 fix.
  4. The child dev stack composes the parent's production host: [Config] Could not load local target for "app.host", using production → https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/host/ with the parent's SRI pin. The child's platform pin does not control the dev host slot.

Expected

The host's per-request auth-context injection (session → user.role, organization.activeOrganizationId / member.role) matches what get-session returns, for child plugin oRPC procedures in dev remote-host composition.

Design ask: make the dev host slot pinnable / self-contained for child CI

A child's app.host development target resolves "production" — the CDN serves only "current" root files (overwritten per deploy); versions/*.json entries are metadata, not addressable bundles; and there is no local-host target a child can run (children have no host workspace). Consequences: child dev:ssr CI breaks whenever the parent redeploys (this incident — red since Oct 20 for reasons invisible in the child's diff), and a child cannot pin the host to its platform release. Per ADR 0034 ("one pin, everything derives"), consider:

  • serving versioned host bundle URLs, with the child dev stack resolving app.host from the pinned platform release manifest, or
  • a first-class local-host runner in everything-dev (so host: { development: "local:…" } works for children without a host workspace).

Either would have contained this regression to the parent's own CI instead of failing every child's browser suite.

Repro

  • citynode.app: pnpm run test:regression:browser:dev:ssr — seeds an admin session (admin + member cookies via createAuthTestInstance), loads /admin, expects role-gated sections; the shell's getDiscoveryStudio 403s and sections never render.
  • Any child dev:ssr stack with seeded-cookie sessions composed against the remote parent host.
Lenguaje dominante
TypeScript
Estrellas
5
Forks
3
Merge medio
10 h 38 min
PR fusionados (30 d)
119

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de NEARBuilders/everything-dev

Todos los issues de NEARBuilders/everything-dev

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.