You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Consolidated checklist-maintenance edits falling out of the identity-auth FULL-area QA run (#7663). All five are edits to docs/qa/platform-checklist/ (primarily areas/identity-auth.json) — checklist text / oracle / fixture-note corrections, not product fixes. Each item's product defect, where one exists, is filed separately.
Items
org-membership-team-management clause 1 (and its negative) name the wrong role vocabulary. The enforced builtin set is {owner, admin, delegated_admin, member} per ADR-0108 (BUILTIN_MEMBERSHIP_ROLE_OPTIONS, "nothing widens these at boot any more") — not{owner, admin, member, guest}. guest is actually rejected (400 ROLE_NOT_FOUND), and delegated_admin is legitimate. The stale spec doc-comment on MemberSchema.role (packages/spec/src/identity/organization.zod.ts:84-87, "Common roles: 'owner', 'admin', 'member', 'guest'"; the .describe(...) at line 87 repeats it) is probably where the checklist text came from — fix both the checklist clause and the spec doc-comment. (The spec doc-comment edit is a packages/spec change, so it may warrant its own tiny domain:spec PR; the checklist clause is the domain:devx part.)
invitation-scope-gates clause 6 conflates two axes.DelegableScope models ObjectStack positions / permission sets / business units and has no field that could carry a better-auth org invitation role, so it can never "contain member". The delegate demonstrably can mint a member invitation while the endpoint reports an empty assignable set — it under-reports, never over-reports (the safe direction). The clause needs a revision, not a product fix.
admin-lifecycle-operations clause 4 should name the authed-request oracle, not get-session's status code. better-auth's no-session convention is 200-with-null-body, so the clause's literal 401 expectation misdescribes a correct implementation. The session was provably gone; the clause should assert against a protected authed request, not get-session's status.
identity-import-wizard — add the fixture note that the auto policy's temporary-fallback branch cannot occur on objectstack dev: both transports always register and dev.ts hard-sets NODE_ENV='development' so isPhoneOtpDeliverable() cannot be made false. Record as a fixture note so the next sweep does not re-derive it.
Source
Extracted from the QA run #7663 (framework 92f26f7, console 09987b680).
Summary
Consolidated checklist-maintenance edits falling out of the identity-auth FULL-area QA run (#7663). All five are edits to
docs/qa/platform-checklist/(primarilyareas/identity-auth.json) — checklist text / oracle / fixture-note corrections, not product fixes. Each item's product defect, where one exists, is filed separately.Items
org-membership-team-managementclause 1 (and its negative) name the wrong role vocabulary. The enforced builtin set is{owner, admin, delegated_admin, member}per ADR-0108 (BUILTIN_MEMBERSHIP_ROLE_OPTIONS, "nothing widens these at boot any more") — not{owner, admin, member, guest}.guestis actually rejected (400ROLE_NOT_FOUND), anddelegated_adminis legitimate. The stale spec doc-comment onMemberSchema.role(packages/spec/src/identity/organization.zod.ts:84-87, "Common roles: 'owner', 'admin', 'member', 'guest'"; the.describe(...)at line 87 repeats it) is probably where the checklist text came from — fix both the checklist clause and the spec doc-comment. (The spec doc-comment edit is apackages/specchange, so it may warrant its own tinydomain:specPR; the checklist clause is thedomain:devxpart.)invitation-scope-gatesclause 6 conflates two axes.DelegableScopemodels ObjectStack positions / permission sets / business units and has no field that could carry a better-auth org invitation role, so it can never "contain member". The delegate demonstrably can mint a member invitation while the endpoint reports an empty assignable set — it under-reports, never over-reports (the safe direction). The clause needs a revision, not a product fix.admin-lifecycle-operationsclause 4 should name the authed-request oracle, notget-session's status code. better-auth's no-session convention is 200-with-null-body, so the clause's literal 401 expectation misdescribes a correct implementation. The session was provably gone; the clause should assert against a protected authed request, notget-session's status.teams-bu-membership— retire theknownGap(a BU-consuming geometry does ship:share_new_inquiries_with_field_ops, so the clause runs) and add the zero-seeded-placements note: a fresh boot seeds the BU tree but zerosys_business_unit_memberrows, so the rule materializes nothing until a tester places someone (theseed-data-thintrap for this item). (Product defect from this clause filed separately as teams-bu-membership: sharing-rule revocation is lazy — a BU moved OUT of a shared subtree keeps read access until the shared record is next written #7729.)identity-import-wizard— add the fixture note that theautopolicy's temporary-fallback branch cannot occur onobjectstack dev: both transports always register anddev.tshard-setsNODE_ENV='development'soisPhoneOtpDeliverable()cannot be made false. Record as a fixture note so the next sweep does not re-derive it.Source
Extracted from the QA run #7663 (framework 92f26f7, console 09987b680).