feat(auth): password-policy & session settings — live, enforced (P0 security)

[os-zhuang]

P0 base-settings, item 3 of 3. Per the agreed scope, this extends the existing auth manifest with the security-policy keys that are genuinely enforced today — rather than standing up a security namespace full of non-functional toggles (IP allowlist / SSO / SCIM / rate-limit), which would be false surface and trip the platform's own liveness gate.

What's added (all live)

Existing auth manifest (global scope), new groups:

• Password policy — password_min_length (default 8), password_max_length (default 128). better-auth enforces these on sign-up and password reset.
• Sessions — session_expiry_days (default 7, absolute lifetime), session_refresh_days (default 1, refresh threshold).

How they take effect (existing tested path)

They ride AuthPlugin.bindAuthSettings → AuthManager.applyConfigPatch:

• Read from the settings service on kernel:ready and re-applied live via settings.subscribe('auth').
• applyConfigPatch deep-merges into config and nulls the cached better-auth instance, so the next request rebuilds with the new policy.
• Days → seconds for session.{expiresIn,updateAge}. Unset (source: 'default') and malformed/non-positive values are ignored so the provider default holds.

Deliberately out of scope (no enforcement exists → NOT declared)

MFA-required, IP allowlist, SSO/SAML, SCIM, API rate limits, password complexity/rotation/history. These are real features to build, not settings toggles. Recorded so the gap is explicit.

Tests

• auth.manifest.test.ts — new number fields parse with bounds/defaults; password_policy/sessions groups present.
• auth-plugin.test.ts — bindAuthSettings applies length bounds + session lifetime (days→seconds); ignores default-source and malformed/non-positive values.
• Suites green: service-settings 124, plugin-auth 120. DTS builds clean.
• en + zh-CN translations.

P0 complete

1. ✅ localization (feat(settings): localization settings — platform timezone/language/formats (ADR-0053 Phase 2) (#1928) #2006). 2. ✅ company (feat(settings): company settings — legal organization identity (P0) #2010). 3. this PR auth security policy.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jun 17, 2026 7:11am

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/plugin-auth, packages/services.

14 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/implementation-status.mdx(via @objectstack/plugin-auth)
• content/docs/concepts/packages.mdx(via @objectstack/plugin-auth)
• content/docs/getting-started/cli.mdx(via @objectstack/plugin-auth)
• content/docs/guides/auth-sso.mdx(via @objectstack/plugin-auth)
• content/docs/guides/authentication.mdx(via @objectstack/plugin-auth)
• content/docs/guides/kernel-services.mdx(via @objectstack/plugin-auth)
• content/docs/guides/packages.mdx(via @objectstack/plugin-auth, packages/services)
• content/docs/guides/plugins.mdx(via @objectstack/plugin-auth)
• content/docs/guides/production-readiness.mdx(via @objectstack/plugin-auth)
• content/docs/guides/runtime-services/audit-service.mdx(via packages/services)
• content/docs/guides/runtime-services/index.mdx(via packages/services)
• content/docs/guides/runtime-services/settings-service.mdx(via packages/services)
• content/docs/protocol/objectos/i18n-standard.mdx(via packages/services)
• content/docs/releases/v9.mdx(via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.