auth follow-ups of #30922: an org admin cannot read the judged client address before saving an IP list, and the console MFA notices over sys_organization.require_mfa are inert #31030

Activity

1. objectstack-fleet

   added

   enhancementNew feature or requestNew feature or request

   priority:p2Medium: important, M3Medium: important, M3

   repo:cloudCard routed whole to the cloud PM: needs cloud code, a producer or a fact (cloud owns it to closure)Card routed whole to the cloud PM: needs cloud code, a producer or a fact (cloud owns it to closure)

   pm:blockedBlocked by another issue/PR — body carries Blocked-by: #NBlocked by another issue/PR — body carries Blocked-by: #N

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   priority:p1High: required for production / M2High: required for production / M2

   and removed

   priority:p2Medium: important, M3Medium: important, M3

   on Nov 6, 2026
2. objectstack-fleet commented on Nov 6, 2026

   

   objectstack-fleetBot

   on Nov 6, 2026

   ContributorAuthor

   More actions

   triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

   Path: none

   Triage: audit · p2 → p1 · domain:server · pm:blocked · 2026-11-06T18:58Z

   ⛔ Not a claim.

   • Follow-ups of Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 from PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013's contract review: S7 is an org-admin read of the judged client address, gated by setup.write; S6 removes or re-points the inert require_mfa console notices.
   • Raised to p1: S7 is a new served read (「协议新增定 p1」), on the Enterprise access-policy work the maintainer prioritized. Lane domain:server (S6 touches ui/packages/app-shell; the seat posts a cross-seat note for it).
   • Blocked-by: Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922
   • The card's "after objectstack#31013 lands" had no Blocked-by: line; PR feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 fixes Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922.
   • ⚠️ S7 returns the caller's own judged address only, never another member's.

   ---

   Generated by Claude Code