Stale docblock in managed-object-write-denies.ts still claims member_default grants CRUD via a '*' wildcard (removed by #5491) #13822

Description

@claude

What is stale

The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:

The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...

member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:

// [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
// baseline -- it resolves for EVERY authenticated member -- and object
// permissions merge most-permissively, so a wildcard here was not a
// default, it was a FLOOR no app could get under.

That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."

Why it is worth a card rather than a shrug

The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.

MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.

Measured

Reading main @ 6b285eca4:

managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."

Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.

Suggested shape

One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.

Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.

Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.

Generated by Claude Code


Generated by Claude Code

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
    }
    } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
    })();
    (function(){
    try {
    var __m = "github.com";
    var __re = new RegExp('^' + "github\\.com" + '
    
    Skip to content

    Stale docblock in managed-object-write-denies.ts still claims member_default grants CRUD via a '*' wildcard (removed by #5491) #13822

    Description

    @claude

    What is stale

    The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:

    The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...

    member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:

    // [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
    // baseline -- it resolves for EVERY authenticated member -- and object
    // permissions merge most-permissively, so a wildcard here was not a
    // default, it was a FLOOR no app could get under.
    

    That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."

    Why it is worth a card rather than a shrug

    The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.

    MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.

    Measured

    Reading main @ 6b285eca4:

    managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
    default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."
    

    Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.

    Suggested shape

    One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.

    Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.

    Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.

    Generated by Claude Code


    Generated by Claude Code

    Metadata

    Metadata

    Assignees

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
      Skip to content

      Stale docblock in managed-object-write-denies.ts still claims member_default grants CRUD via a '*' wildcard (removed by #5491) #13822

      Description

      @claude

      What is stale

      The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:

      The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...

      member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:

      // [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
      // baseline -- it resolves for EVERY authenticated member -- and object
      // permissions merge most-permissively, so a wildcard here was not a
      // default, it was a FLOOR no app could get under.
      

      That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."

      Why it is worth a card rather than a shrug

      The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.

      MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.

      Measured

      Reading main @ 6b285eca4:

      managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
      default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."
      

      Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.

      Suggested shape

      One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.

      Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.

      Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.

      Generated by Claude Code


      Generated by Claude Code

      Metadata

      Metadata

      Assignees

      Type

      No type

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions

        , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
        Skip to content

        Stale docblock in managed-object-write-denies.ts still claims member_default grants CRUD via a '*' wildcard (removed by #5491) #13822

        Description

        @claude

        What is stale

        The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:

        The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...

        member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:

        // [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
        // baseline -- it resolves for EVERY authenticated member -- and object
        // permissions merge most-permissively, so a wildcard here was not a
        // default, it was a FLOOR no app could get under.
        

        That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."

        Why it is worth a card rather than a shrug

        The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.

        MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.

        Measured

        Reading main @ 6b285eca4:

        managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
        default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."
        

        Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.

        Suggested shape

        One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.

        Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.

        Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.

        Generated by Claude Code


        Generated by Claude Code

        Metadata

        Metadata

        Assignees

        Type

        No type

        Projects

        No projects

          Milestone

          No milestone

          Relationships

          None yet

          Development

          No branches or pull requests

          Issue actions

          , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
          Skip to content

          Stale docblock in managed-object-write-denies.ts still claims member_default grants CRUD via a '*' wildcard (removed by #5491) #13822

          Description

          @claude

          What is stale

          The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:

          The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...

          member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:

          // [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
          // baseline -- it resolves for EVERY authenticated member -- and object
          // permissions merge most-permissively, so a wildcard here was not a
          // default, it was a FLOOR no app could get under.
          

          That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."

          Why it is worth a card rather than a shrug

          The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.

          MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.

          Measured

          Reading main @ 6b285eca4:

          managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
          default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."
          

          Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.

          Suggested shape

          One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.

          Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.

          Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.

          Generated by Claude Code


          Generated by Claude Code

          Metadata

          Metadata

          Assignees

          Type

          No type

          Projects

          No projects

            Milestone

            No milestone

            Relationships

            None yet

            Development

            No branches or pull requests

            Issue actions

            , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
            Skip to content

            Stale docblock in managed-object-write-denies.ts still claims member_default grants CRUD via a '*' wildcard (removed by #5491) #13822

            Description

            @claude

            What is stale

            The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:

            The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...

            member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:

            // [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
            // baseline -- it resolves for EVERY authenticated member -- and object
            // permissions merge most-permissively, so a wildcard here was not a
            // default, it was a FLOOR no app could get under.
            

            That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."

            Why it is worth a card rather than a shrug

            The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.

            MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.

            Measured

            Reading main @ 6b285eca4:

            managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
            default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."
            

            Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.

            Suggested shape

            One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.

            Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.

            Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.

            Generated by Claude Code


            Generated by Claude Code

            Metadata

            Metadata

            Assignees

            Type

            No type

            Projects

            No projects

              Milestone

              No milestone

              Relationships

              None yet

              Development

              No branches or pull requests

              Issue actions

              , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
              Skip to content

              Stale docblock in managed-object-write-denies.ts still claims member_default grants CRUD via a '*' wildcard (removed by #5491) #13822

              Description

              @claude

              What is stale

              The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:

              The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...

              member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:

              // [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
              // baseline -- it resolves for EVERY authenticated member -- and object
              // permissions merge most-permissively, so a wildcard here was not a
              // default, it was a FLOOR no app could get under.
              

              That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."

              Why it is worth a card rather than a shrug

              The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.

              MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.

              Measured

              Reading main @ 6b285eca4:

              managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
              default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."
              

              Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.

              Suggested shape

              One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.

              Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.

              Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.

              Generated by Claude Code


              Generated by Claude Code

              Metadata

              Metadata

              Assignees

              Type

              No type

              Projects

              No projects

                Milestone

                No milestone

                Relationships

                None yet

                Development

                No branches or pull requests

                Issue actions

                , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
                Skip to content

                Stale docblock in managed-object-write-denies.ts still claims member_default grants CRUD via a '*' wildcard (removed by #5491) #13822

                Description

                @claude

                What is stale

                The module docblock of packages/plugins/plugin-security/src/managed-object-write-denies.ts opens by describing the default sets it operates on:

                The default write-granting permission sets (organization_admin, member_default, viewer_readonly, and the MCP write set) grant CRUD via a '*' wildcard, then DENY writes on the better-auth-managed identity tables...

                member_defaultno longer grants CRUD via a '*' wildcard, and has not since #5491. Its own declaration in objects/default-permission-sets.ts now says the opposite, in terms, at the top of the block:

                // [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
                // baseline -- it resolves for EVERY authenticated member -- and object
                // permissions merge most-permissively, so a wildcard here was not a
                // default, it was a FLOOR no app could get under.
                

                That change carried a maintainer ruling (2026-08-07): "the platform baseline narrows to explicit-allow... do not reintroduce a wildcard here 'with a priority', and do not reintroduce one at all."

                Why it is worth a card rather than a shrug

                The two files disagree about which principals hold a blanket write grant — the exact question the security package exists to answer, in the file whose whole purpose is keeping the permission layer from "silently disagree[ing] with the schemas". A reader who trusts the docblock concludes that every authenticated member carries wildcard CRUD, which is the pre-#5491 vulnerability, not current behaviour.

                MANAGED_DENY_TARGET_SETS still legitimately lists member_default (the deny entries are harmless and the list is a deliberate allowlist), so nothing is behaviourally wrong here — this is the prose, and only the prose.

                Measured

                Reading main @ 6b285eca4:

                managed-object-write-denies.ts:7-9 names member_default among sets that "grant CRUD via a '*' wildcard"
                default-permission-sets.ts:394 "[#5491] NO `'*'` WILDCARD GRANT."
                

                Control that the scan reads the file at all: git grep -c "sys_user" -- .../objects/default-permission-sets.ts -> 28.

                Suggested shape

                One-line correction to the docblock: name the sets that actually carry a write-granting wildcard (organization_admin, its derived _no_bypass variant, viewer_readonly's read-only wildcard, the MCP write set) and state that member_default is in MANAGED_DENY_TARGET_SETS for belt-and-braces reasons rather than because it holds a wildcard.

                Observation-class: prose drift, no behaviour change. Filed unassigned, for triage.

                Measured while answering the authoring-reach census on #13566; filed separately so it does not live only in that comment's margins.

                Generated by Claude Code


                Generated by Claude Code

                Metadata

                Metadata

                Assignees

                Type

                No type

                Projects

                No projects

                  Milestone

                  No milestone

                  Relationships

                  None yet

                  Development

                  No branches or pull requests

                  Issue actions