Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

rc.22+ auth plugin disables better-auth organization/list-members but createAuthClient still ships organizationClient — child UIs silently lose member roles (403)

Abierto
  • ¿Algo no está bien?
#632 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
45/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
typescript
Área
api, authentication

Línea de trabajo

Start by reading createAuthClient in everything-dev/ui/auth and the auth RPC listMembers procedure; the issue identifies both the stock organizationClient() setup and the replacement endpoint. Check how the client exposes organization calls and how the RPC client sends its envelope, then compare the list-organizations call sites. Done when organization member queries reach the supported endpoint and the stranded organization list call sites are accounted for.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

Summary

Since rc.22, the parent's auth plugin disables better-auth's built-in POST /api/auth/organization/list-members endpoint (server responds 403 with "Use POST /api/rpc/auth/listMembers — member emails are permission-filtered there"). But the framework's own client factory — everything-dev/ui/auth createAuthClient — still mounts the stock organizationClient() with no client-side remap. Any child calling auth.organization.listMembers(...) now gets 403, the query throws, and member roles silently resolve to undefined. There is no compile-time or runtime signal pointing children at the replacement.

This is the client/server skew class from #531's closure notes (the skew there was composition-level; this one is API-level), and it bit citynode.app's browser regression suite red from rc.22 through rc.24.

Evidence (citynode.app child, extends: bos://dev.everything.near/everything.dev, platform rc.22→rc.24)

  1. Server: GET /api/auth/organization/list-members?organizationId=… → 403 {"message":"Use POST /api/rpc/auth/listMembers — member emails are permission-filtered there"}. Also GET /api/auth/organization/list-organizations → 404. Meanwhile organization/get-full-organization still works, and the server-injected context is complete — POST /api/rpc/auth/getContext returns the full envelope with organization.activeOrganizationId, member.role: "owner", permissions.
  2. Client: [email protected]/dist/ui/auth.mjs line ~120: organizationClient({ teams: { enabled: true } }) — stock better-auth client, no interceptors/remap; the string listMembers appears nowhere in the package.
  3. Replacement works: POST /api/rpc/auth/listMembers with the standard oRPC envelope {"json":{"organizationId":…}} → 200 {"members":[…role:"owner"…],"total":1}. (Note: a raw body {organizationId:…} — the shape the api-plugin oRPC mount accepts — gets 400 "expected object, received undefined" on this mount, another trap for children hand-rolling the call.)
  4. Child symptom: memberRole undefined → tenant-detail gate renders "Community not found" for owners → 8 browser regression specs red (tenancy, team-workspace, community-map-status, community-settings-*, discovery-profile-save, organization-approval, organizer-stations). Green on rc.21, red since rc.22.

Fixed on the child side in https://github.com/NEARBuilders/citynode.app/pull/446 by switching fetchOrgMembers to apiClient.auth.listMembers (the oRPC surface listOrganizations/listUserInvitations already use).

Ask

Pick one (or both):

  1. Remap in the framework client — intercept organization.listMembers in createAuthClient (custom fetch hook / client plugin) and route it to the oRPC procedure, so stock organizationClient() calls keep working; or
  2. Ship a helper — export an orgMembersQueryOptions-style helper (and a documented members surface) from everything-dev/ui/auth so children don't hand-roll the oRPC call or rediscover the envelope shape.

Also consider whether organization/list-organizations (404) left any other client call sites stranded.

Repro

On any child at platform ≥ rc.22, signed in with an org owner session, authClient.organization.listMembers({ query: { organizationId } }) → 403 with the reroute message; useOrgMemberRole-style consumers render locked/unavailable states.

Lenguaje dominante
TypeScript
Estrellas
5
Forks
3
Merge medio
9 h 48 min
PR fusionados (30 d)
152

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de NEARBuilders/everything-dev

Todos los issues de NEARBuilders/everything-dev

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.