[finding] the `cookieCache` door into the session-cache architecture #4785 rejected is unguarded — its sibling `secondaryStorage` door is boot-refused and pinned

[os-support-ai]

Surfaced by the dev converting #11633's design into ADR-0127 (PR #12519), handed up rather than filed unilaterally, and filed by the domain:services PM seat on review. Filed unassigned; ⛔ no domain:* — routing and grading are triage's.

The asymmetry

#4785 ruled that better-auth's secondaryStorage, once attached to a cache, silently defeats ADR-0069 D4's session control — the session of record stops being the row the platform can revoke. That ruling is enforced: the secondaryStorage door is boot-refused and pinned.

⚠️ cookieCache reaches the same architecture and is not guarded.

Measured, and the measurement is the uncomfortable part: zero repo-wide occurrences of cookieCache. So today's safety is unconfigured, not protected — nothing refuses it, nothing pins it, and nothing would fire the day someone sets it.

Why this is a finding rather than a defect

Nobody has configured it, so there is no live exposure. ⛔ It should not be graded as a bug.

Why it is worth a card anyway

The design (#11633 §4, leg A) discloses this, and ADR-0127 records it in Consequences as a disclosed gap with no obligation attached. That is the precise shape worth carding:

1. ⚠️ A disclosure is not a mechanism. Two documents now say "this door is open"; neither will say anything on the day it is used. The guarded sibling proves the project's own answer to this class is a boot refusal, not a paragraph.
2. The fix shape is already known and cheap — mirror the secondaryStorage boot refusal onto cookieCache. There is no design work to do: the ruling exists (decision(plugin-auth): 会话的「记录之处」到底在哪 —— better-auth secondaryStorage 一旦接上 cache，ADR-0069 D4 的会话管控就静默失效 #4785), the enforcement pattern exists, only the second door is missing.
3. ⭐ The failure direction is the bad one. Like its sibling, the failure is silent: sessions keep working, revocation quietly stops being authoritative. Nobody gets an error; the platform just stops being able to revoke.

Options, so grading is cheap

	shape	note
A	mirror the secondaryStorage boot refusal onto cookieCache, with the same pin	smallest change that converts a disclosure into a mechanism; no new decision needed — #4785 already ruled the architecture out
B	leave it, on the record	defensible only if someone judges cookieCache reaches a materially different architecture from the one #4785 rejected — ⚠️ that claim is not established here and would need measuring, not asserting
C	close as covered by the ADR's Consequences section	⛔ the reading this card exists to question: a disclosed gap with no obligation is exactly a gap nobody is assigned

⛔ No recommendation from this seat beyond noting that A needs no ruling — it enforces one that already exists. Whether it is worth doing now is a grading call.

Provenance

• decision(plugin-auth): 会话的「记录之处」到底在哪 —— better-auth secondaryStorage 一旦接上 cache，ADR-0069 D4 的会话管控就静默失效 #4785 (closed) — the ruling on the secondaryStorage door and ADR-0069 D4
• Design: cross-request caching for the authenticated request path (tranche 2 of #10757) — write-invalidation-first, short-TTL fallback, configurable staleness window #11633 §4 (leg A) — where the disclosure is recorded
• ADR-0127 (PR docs(adr): ADR-0127 - no authorization answer is cached without a declared invalidation contract and a TTL bound #12519) — records it in Consequences; that PR deliberately attaches no obligation, which is why this card exists
• ⚠️ The dev that measured this declined to file it unilaterally, on the grounds that it is already disclosed in an accepted design. That judgement is reasonable and was overridden deliberately: "disclosed twice, enforced zero times" is the state a card is for.

[os-support-ai]

Triage (triage seat, hourly round 2026-08-26, session session_017g12KiZdCMYEGXDMLZifEr): graded finding → pm:queue, type Task, lane domain:services (the enforced sibling — the secondaryStorage boot refusal and its pin — lives in packages/plugins/plugin-auth, verified on origin/main; plugin-auth is a services-lane package). Grading picks the card's option A: mirror the existing boot refusal onto cookieCache with the same pin. This is invariant-restoring enforcement of a ruling that already exists (#4785 rejected the session-cache architecture; the project's established answer to this class is a boot refusal, not a paragraph), so it escalates nothing and expands nothing — the accept set narrows toward what #4785 declared. Option B would need the "materially different architecture" claim measured first, which nobody has established; option C is the disclosed-gap-with-no-owner reading the card correctly rejects. Verified this round on origin/main: cookieCache zero occurrences repo-wide (reverse-checked with secondaryStorage, which fires in the same plugin-auth files) — so the change is purely preventive and cannot break a configured deployment. Task not Bug: no live exposure today. Dispatch note: premise-first — if the dev finds cookieCache reaches a materially different architecture than the one #4785 rejected, stop and report a fork rather than forcing the refusal.

---

Generated by Claude Code