Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Host-injected auth context loses user.role/organization in child dev:ssr stacks — role/org-gated plugin RPCs 403 (seeded-session suites red through rc.17)

Aperta
  • Qualcosa non va?
#531 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
authentication, backend-api-design, devops

Direzione di ricerca

Start by tracing the host's per-request auth-context injection from the resolved session into child plugin oRPC procedures, then compare the injected role and organization fields with the get-session response and the role-gated getDiscoveryStudio failure. The issue also asks for a design decision on pinning the dev host slot or providing a local-host runner. Done means child dev:ssr stacks receive the session's role and organization context, and a host-pinning approach is defined; no relevant source files or tests are named.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug

Summary

Follow-up to #527 (closed by the rc.16 null-session fix — that cleared the 307 wall; authed routes now render in child dev:ssr stacks). The remaining half is still red: the host resolves the session but injects a request context without user.role / organization into the child plugins' oRPC procedures. Every role/org-gated procedure 403s, so every seeded-session browser test times out at ~15s. Still reproduces against the rc.17-pinned host (parent republished bos.config.json 2026-10-21 15:47 UTC; host pin manifest gitSha 553a9b2 = the v2.0.0-rc.17 release commit).

Evidence (citynode.app child, extends: bos://dev.everything.near/everything.dev)

  1. The session is valid and fully resolvable — get-session via curl returns the full session with role: "admin" (see #527 repro; still true post-rc.16).
  2. Authed pages render and the client fires data calls — so the 307 wall is gone. But the server-injected context disagrees with the session:
    • POST /api/rpc/getDiscoveryStudio → 403 (Forbidden / Code: FORBIDDEN). The child handler is requireCurator(context): a missing user fails UNAUTHORIZED; a resolved user without admin/curator fails FORBIDDEN. We observe FORBIDDEN — a user was injected, but not as admin.
    • getDiscoveryStudio is called from the shell layout (use-shell-nav) on every authed page — the client session says admin, the injected context says otherwise.
    • Org-gated procedures (requireTenantOwnedByOrg, authorizeNodeAccess) fail the same way; org-switcher specs (need organization.activeOrganizationId) all fail.
    • Result: every seeded-cookie spec fails; every signed-out spec passes. Local run 2026-10-21 16:21 UTC (everything-dev rc.17 + the rc.17-pinned host): 55 ✘ / 3 ✓.
  3. Timeline (child CI on main):
    • Green 2026-10-19 (run 39255126057) against the then-current parent host.
    • The parent redeployed the host between Oct 19–20. First-red run 39509211093 (2026-10-20 22:35 UTC) shows the skew phase: [SharedIdentity] Refusing to load plugin "@everything-dev/auth-plugin": shared dependency version skew. every-plugin: expected 3.0.0-rc.9 (from this runtime), got 3.0.0-rc.6 → "Serving without the API: all /api/* routes return 503" (fast total failure).
    • After the child upgraded (rc.14 → rc.15 → rc.17; every-plugin rc.9/rc.10), plugins load again — but the auth-context failure persists through rc.17. So the regression was introduced host-side with the rc.13-era host and is not covered by the #527 fix.
  4. The child dev stack composes the parent's production host: [Config] Could not load local target for "app.host", using production → https://cdn.everything.dev/bundles/dev.everything.near/everything.dev/host/ with the parent's SRI pin. The child's platform pin does not control the dev host slot.

Expected

The host's per-request auth-context injection (session → user.role, organization.activeOrganizationId / member.role) matches what get-session returns, for child plugin oRPC procedures in dev remote-host composition.

Design ask: make the dev host slot pinnable / self-contained for child CI

A child's app.host development target resolves "production" — the CDN serves only "current" root files (overwritten per deploy); versions/*.json entries are metadata, not addressable bundles; and there is no local-host target a child can run (children have no host workspace). Consequences: child dev:ssr CI breaks whenever the parent redeploys (this incident — red since Oct 20 for reasons invisible in the child's diff), and a child cannot pin the host to its platform release. Per ADR 0034 ("one pin, everything derives"), consider:

  • serving versioned host bundle URLs, with the child dev stack resolving app.host from the pinned platform release manifest, or
  • a first-class local-host runner in everything-dev (so host: { development: "local:…" } works for children without a host workspace).

Either would have contained this regression to the parent's own CI instead of failing every child's browser suite.

Repro

  • citynode.app: pnpm run test:regression:browser:dev:ssr — seeds an admin session (admin + member cookies via createAuthTestInstance), loads /admin, expects role-gated sections; the shell's getDiscoveryStudio 403s and sections never render.
  • Any child dev:ssr stack with seeded-cookie sessions composed against the remote parent host.
Lingua principale
TypeScript
Stelle
5
Fork
3
Merge medio
9h 55m
PR unite (30g)
108

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NEARBuilders/everything-dev

Tutte le issue di NEARBuilders/everything-dev

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.