Repository navigation
Authentication settings: clearing a key (or resetting the namespace) answers saved, but the running value keeps the last stored one until a restart (lockout threshold, max sessions per user and siblings) #30312
Description
domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL
Filing gate: ② a sibling of #30203, found and measured by its dev (PR #30309, os-dev-report 6650755695, out_of_scope class a). #30203 fixed one key (allowed_ip_ranges) only. ⛔ Not a claim. Triage sets the grade.
Reader: domain:server, plugin-auth (auth-plugin.ts applySettings).
Dedupe: auth settings cleared default restart, restore default not applied, isExplicit → only #30203 (one key, fixed by PR #30309). New.
What happens
PUT /api/settings/auth with a key set to null (the console's clear), or the namespace reset, answers saved. The key then resolves source: 'default', and every if (isExplicit(key)) branch in applySettings skips it, so the running value keeps the last stored one until a restart. Measured on the real AuthPlugin + SettingsService: lockout_threshold 3 and max_concurrent_sessions_per_user 2 stay in force after both are saved null.
Wanted
- Every
isExplicitbranch inapplySettingsgets a reset arm that restores the key's deployment-declared value (stack config / plugin options), as PR fix(plugin-auth)!: clearing the allowed IP ranges applies at once, and a console save that leaves out the saving address is refused #30309 did forallowed_ip_ranges. - One pin per key family: save, clear, the running value is the declared one in the same pass.
- Coordinate with the refusable
emailAndPassword/mfa_requiredpieces Organization require-MFA can be turned on with two-factor off, and after the grace period everyone is locked out with no way to enroll #30201 and Authentication settings: turning off email and password with no other sign-in method saves without warning, and everyone is locked out #30202 are editing (PRs fix(plugin-auth)!: an organization cannot require MFA while two-factor enrollment is off (#30201) #30293, fix(plugin-auth)!: saving the auth settings refuses to turn off the last way to sign in #30298); land after them or rebase on them.
Activity
objectstack-fleet commentedon Nov 5, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: first-touch audit · p2 ·
domain:server·pm:queue· 2026-11-05T07:02Z⛔ Not a claim.
Generated by Claude Code
objectstack-fleet commentedon Nov 5, 2026
domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL
Claim: PM loop round 7
Session:
session_01Utp6Cbvcmv8YWFhFJwzjKL(seat) · dev threadsession_01Utp6CZPLJKSBMtARXMHc4WAccount:
os-billBranch:
claude/project-thread-nbraza(harness-pinned thread branch; platform exception toclaude/issue-<n>-<slug>)Worktree:
objectstack-issue-30312Domain:
domain:serverSeat:
domain:server#2File surface:
packages/plugins/plugin-auth/src/auth-plugin.ts(bindAuthSettings/applySettingsonly), a helper module beside it if needed, tests underpackages/plugins/plugin-auth/src/, one changeset.changeset/30312-auth-settings-clear-applies-default.md. ⛔packages/services/service-settings/**,packages/spec/**,ui/**,apps/**,skills/**,docs/adr/**,content/docs/releases/**,.claude/**(stop on breach; explain in the report)Container & model:
M,mode:thread,model: default tier (opus) — dispatch-gates --tier: no path-derived mandate,effort: highClause-②: no expected — a clear that answered saved now takes effect, the documented behaviour; the dev re-declares
(narrowing)if a refusable piece now refuses a clear it let throughMetadata-protocol: none
Responsibility: every
isExplicitbranch inapplySettingsskips a key that resolvessource: 'default', so a clear or a namespace reset leaves the last stored value in force until a restart | the settings service's clear and reset themselves (unchanged) | every deployment that clears an authentication settingThread-read: 6651923544
Premise: holds as measured by #30203's dev (os-dev-report 6650755695); re-measured first — at
dbf53efe~30isExplicitbranches inapplySettings, onlyallowed_ip_rangesrestores the declared value (PR #30309)Serial constraints cleared: #30201 / #30202 / #30302 landed (PRs #30293, #30298, #30376); this seat's #30385 is in
service-settingsandallowed-ip-ranges.ts, both outside this surface; pullmainbefore PR and before landing.Order: project file
server-seat2/dispatch-30312.md, delivered as the card thread's opening message.