rc.22+ auth plugin disables better-auth organization/list-members but createAuthClient still ships organizationClient — child UIs silently lose member roles (403)
メンテナーはふだん 1 日以内に返信
まだ誰も着手していません。
評価
- 難易度
- 4/5
- 見積もり時間
- 3〜5日
- 初心者へのやさしさ
- 45/100
- issue の種類
- バグ
- 明瞭さ
- おおむね明確
- 活発さ
- 活発
- 技術スタック
- typescript
- 領域
- api, authentication
調査の方向性
Start by reading createAuthClient in everything-dev/ui/auth and the auth RPC listMembers procedure; the issue identifies both the stock organizationClient() setup and the replacement endpoint. Check how the client exposes organization calls and how the RPC client sends its envelope, then compare the list-organizations call sites. Done when organization member queries reach the supported endpoint and the stranded organization list call sites are accounted for.
索引モデルが issue の本文から書いたものです。
説明
Summary
Since rc.22, the parent's auth plugin disables better-auth's built-in POST /api/auth/organization/list-members endpoint (server responds 403 with "Use POST /api/rpc/auth/listMembers — member emails are permission-filtered there"). But the framework's own client factory — everything-dev/ui/auth createAuthClient — still mounts the stock organizationClient() with no client-side remap. Any child calling auth.organization.listMembers(...) now gets 403, the query throws, and member roles silently resolve to undefined. There is no compile-time or runtime signal pointing children at the replacement.
This is the client/server skew class from #531's closure notes (the skew there was composition-level; this one is API-level), and it bit citynode.app's browser regression suite red from rc.22 through rc.24.
Evidence (citynode.app child, extends: bos://dev.everything.near/everything.dev, platform rc.22→rc.24)
- Server:
GET /api/auth/organization/list-members?organizationId=…→403 {"message":"Use POST /api/rpc/auth/listMembers — member emails are permission-filtered there"}. AlsoGET /api/auth/organization/list-organizations→404. Meanwhileorganization/get-full-organizationstill works, and the server-injected context is complete —POST /api/rpc/auth/getContextreturns the full envelope withorganization.activeOrganizationId,member.role: "owner", permissions. - Client:
[email protected]/dist/ui/auth.mjsline ~120:organizationClient({ teams: { enabled: true } })— stock better-auth client, no interceptors/remap; the stringlistMembersappears nowhere in the package. - Replacement works:
POST /api/rpc/auth/listMemberswith the standard oRPC envelope{"json":{"organizationId":…}}→200 {"members":[…role:"owner"…],"total":1}. (Note: a raw body{organizationId:…}— the shape the api-plugin oRPC mount accepts — gets400 "expected object, received undefined"on this mount, another trap for children hand-rolling the call.) - Child symptom:
memberRoleundefined → tenant-detail gate renders "Community not found" for owners → 8 browser regression specs red (tenancy, team-workspace, community-map-status, community-settings-*, discovery-profile-save, organization-approval, organizer-stations). Green on rc.21, red since rc.22.
Fixed on the child side in https://github.com/NEARBuilders/citynode.app/pull/446 by switching fetchOrgMembers to apiClient.auth.listMembers (the oRPC surface listOrganizations/listUserInvitations already use).
Ask
Pick one (or both):
- Remap in the framework client — intercept
organization.listMembersincreateAuthClient(custom fetch hook / client plugin) and route it to the oRPC procedure, so stockorganizationClient()calls keep working; or - Ship a helper — export an
orgMembersQueryOptions-style helper (and a documented members surface) fromeverything-dev/ui/authso children don't hand-roll the oRPC call or rediscover the envelope shape.
Also consider whether organization/list-organizations (404) left any other client call sites stranded.
Repro
On any child at platform ≥ rc.22, signed in with an org owner session, authClient.organization.listMembers({ query: { organizationId } }) → 403 with the reroute message; useOrgMemberRole-style consumers render locked/unavailable states.
- 主要言語
- TypeScript
- スター
- 5
- フォーク
- 3
- 平均マージ
- 9時間 37分
- マージ済み PR（30日）
- 157
環境構築
- Dockerfile または Docker Compose ファイルあり
- プルリクエストのテンプレートなし
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
NEARBuilders/everything-dev のほかの issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 77/100
NEARBuilders/everything-dev#628 · コメント 1 件 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
NEARBuilders/everything-dev#400 ·
メンテナーはふだん 1 日以内に返信
-
難易度 5/5 1週間以上 初心者へのやさしさ 35/100
NEARBuilders/everything-dev#664 ·
メンテナーはふだん 1 日以内に返信
-
難易度 4/5 1〜2日 初心者へのやさしさ 52/100
NEARBuilders/everything-dev#663 ·
メンテナーはふだん 1 日以内に返信
-
難易度 5/5 1週間以上 初心者へのやさしさ 35/100
NEARBuilders/everything-dev#661 ·
メンテナーはふだん 1 日以内に返信
NEARBuilders/everything-dev の issue をすべて見る
似ている issue
-
b:minor bug
難易度 2/5 1〜3時間 初心者へのやさしさ 76/100
software-mansion/argent#1698 ·
メンテナーはふだん 1 日以内に返信
-
e2e-failure ready-to-code
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
redhat-developer/rhdh-plugin-export-overlays#4624 · コメント 1 件 ·
メンテナーはふだん 1 日以内に返信
-
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
better-auth/better-auth#12132 · リアクション 1 件 ·
メンテナーはふだん 1 日以内に返信
-
automation missing-model model-sync provider:tinfoil
難易度 2/5 1〜3時間 初心者へのやさしさ 68/100
anomalyco/models.dev#12053 ·
メンテナーはふだん 1 日以内に返信
-
o8 next debug build aborts on Glass to Dark appearance switch (nil identifier messaged before check)オープンbug
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
hurttlocker/o8#5112 ·