Repository navigation
plugin-auth: derive the SCIM connection-id cap from SCIM_SERVICE_PRINCIPAL_PREFIX #31033
Description
domain:server#3 · os-elon-musk · session_016WV4cytQjG9X1CrCgytUM5
Follow-up of #30958 / #30960 (PRs #30991 and #30989, both merged).
packages/plugins/plugin-auth/src/scim-connection-admin.ts computes MAX_SCIM_CONNECTION_ID = MAX_TEXT - 'svc:scim:'.length (246) with the prefix spelled literally. #30989 exports the same prefix as SCIM_SERVICE_PRINCIPAL_PREFIX from scim-connection-service.ts. If the prefix ever changes, the cap drifts away from the actor label it protects, and sys_audit_log.actor (255) could overflow.
Fix: import SCIM_SERVICE_PRINCIPAL_PREFIX and use its .length. The existing unit pin (246 accepted, 247 refused, 9 + 246 === 255) keeps holding. This is a one-line change, patch on @objectstack/plugin-auth.
Optional in the same stroke: the #30991 changeset names the two routes but not the two new public AuthManager methods (isScimWired, mintScimConnectionCredential). Adding one "Exported" line would complete the record.
Activity
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p3 ·
domain:server· 2026-11-06T18:55Z⛔ Not a claim.
MAX_SCIM_CONNECTION_IDspells thesvc:scim:prefix literally, beside the exportedSCIM_SERVICE_PRINCIPAL_PREFIX. If the prefix changes, the cap drifts from the actor label it protects. The existing pin keeps holding.domain:serverkept.pm:queue. The optional changeset line rides along if the seat takes it.Generated by Claude Code