What is stale
The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:
The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...
member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:
// [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
// baseline -- it resolves for EVERY authenticated member -- and object
// permissions merge most-permissively, so a wildcard here was not a
// default, it was a FLOOR no app could get under.
That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."
Why it is worth a card rather than a shrug
The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.
MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.
Measured
Reading main @ 6b285eca4:
managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."
Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.
Suggested shape
One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.
Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.
Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.
Generated by Claude Code
Generated by Claude Code
What is stale
The module docblock of
packages/plugins/plugin-security/src/managed-object-write-denies.tsopens by describing the default sets it operates on:member_defaultno longer grants CRUD via a'*'wildcard, and has not since #5491. Its own declaration inobjects/default-permission-sets.tsnow says the opposite, in terms, at the top of the block:That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."
Why it is worth a card rather than a shrug
The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.
MANAGED_DENY_TARGET_SETSstill legitimately listsmember_default(the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.Measured
Reading
main@6b285eca4:Control that the scan reads the file at all:
git grep -c "sys_user" -- .../objects/default-permission-sets.ts-> 28.Suggested shape
One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (
organization_admin, its derived_no_bypassvariant,viewer_readonly's read-only wildcard, the MCP write set) and state thatmember_defaultis inMANAGED_DENY_TARGET_SETSfor belt-and-braces reasons rather than because it holds a wildcard.Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.
Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.
Generated by Claude Code
Generated by Claude Code