Auth: the console cannot withdraw an authorized AI assistant: /oauth2/delete-consent has no ledger row or client method, and no admin door #31048

Activity

1. objectstack-fleet

   added

   area:aiAI-native — agent / tool / skill metadata, and the MCP surface an agent drivesAI-native — agent / tool / skill metadata, and the MCP surface an agent drives

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   enhancementNew feature or requestNew feature or request

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   priority:p1High: required for production / M2High: required for production / M2

   on Nov 6, 2026
2. objectstack-fleet commented on Nov 6, 2026

   

   objectstack-fleetBot

   on Nov 6, 2026

   ContributorAuthor

   More actions

   triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

   Path: none

   Triage: audit · p1 · domain:server · 2026-11-06T21:54Z

   ⛔ Not a claim.

   • The console cannot withdraw an authorized AI assistant. POST /oauth2/delete-consent is mounted (auth-route-ledger.ts, L430) but has no AUTH_ROUTE_LEDGER row and no client method; its neighbours carry sdk rows (L173 on). No admin door withdraws for a managed person. Triage re-read the ledger on main.
   • p1: a protocol addition (a ledgered, client-exposed door), on the maintainer's The OAuth consent page promises you can revoke access from your account settings, but no page lists the AI assistants you authorized #30894 order and cloud#3606 ruling A. It is the server half that The OAuth consent page promises you can revoke access from your account settings, but no page lists the AI assistants you authorized #30894's Revoke needs. Lane domain:server (plugin-auth, client). pm:queue.
   • ⚠️ The admin withdraw stays behind the same gate as admin/authorized-clients (Auth: no ledgered read lists the AI assistants a person has authorized, records when one was last used, or lets an admin see a managed person's #30918, security#1's rules). A refusal for anyone outside that scope gives one indistinguishable answer, as the card says.
   • For The OAuth consent page promises you can revoke access from your account settings, but no page lists the AI assistants you authorized #30894's holder (domain:ui#3): add Blocked-by: #31048 to The OAuth consent page promises you can revoke access from your account settings, but no page lists the AI assistants you authorized #30894 if its Revoke half waits on this card, so the unlock sweep and H14 see the order.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   pm:blockingDerived cache from the Blocked-by reverse index: open card with open dependents — never hand-setDerived cache from the Blocked-by reverse index: open card with open dependents — never hand-set

   on Nov 7, 2026
4. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

   Claim: PM loop round 3 · 2026-11-07T00:27Z
   Session: session_01L9qibyvxbrLP4jm4PargoH
   Account: os-tesla (the card's assignee)
   Branch: claude/project-thread-h42d2s (the card thread's designated branch; dev session session_01L9qibxU7nr4BXM7e8qMfwq)
   Worktree: objectstack-issue-31048
   Domain: domain:server
   Seat: domain:server#2
   File surface: packages/plugins/plugin-auth/src/** (the route ledger, the authorized-clients read and a withdraw beside it, the auth-plugin.ts mount lines, their tests), packages/client/src/index.ts (the oauth.authorizedClients methods and the stale delete-consent doc line) and its test, packages/qa/dogfood/test/ (one HTTP pin plus the admin non-admin refusal list if it enumerates the route), the content/docs/** pages that list the authorized-clients doors, one changeset. ⛔ packages/spec/** (a new published key or error code stops and reports), ⛔ ui/** (#30894's half), ⛔ skills/**.
   Container & model: M, mode:thread, model: TIER_DEFAULT, effort: high
   Clause-②: yes (widening)
   Metadata-protocol: none
   Responsibility: the missing door is ours (plugin-auth + client, objectstack): POST /oauth2/delete-consent is mounted with no ledger row or client method, and no admin door withdraws for a managed person. It reaches every person whose authorized assistant must be turned off (cloud#3606 ruling A).
   Thread-read: 6696803075
   Premise: holds. On origin/main 23cf11a4 auth-route-ledger.ts lists POST /api/v1/auth/oauth2/delete-consent only in the mounted surface (L417); the ledger has rows for GET /authorized-clients and GET /admin/authorized-clients (L198–199) and none for a withdraw.
   Serial constraints cleared: none open; #30946 (#30918, the admin read and its gate) landed 6bd00d2a.

   Order: /mnt/project-files/server-seat-2/r2026-11-06/dispatch-31048.md (frame FRAME.md beside it). The ownership measure of better-auth's delete-consent comes first; a defect there routes to security#1 rule-level only.
5. objectstack-fleet

   added

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   and removed

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   on Nov 7, 2026
6. objectstack-fleet

   assigned

   os-tesla

   on Nov 7, 2026
7. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   domain:server#2 · os-tesla · session_01L9qibxU7nr4BXM7e8qMfwq

   os-dev-report

   {
    "issue": 31048,
    "status": "done",
    "branch": "claude/project-thread-h42d2s",
    "pr": "https://github.com/objectstack-ai/objectstack/pull/31073",
    "session": "session_01L9qibxU7nr4BXM7e8qMfwq",
    "premise_still_valid": true,
    "summary": "Design (b): two ObjectStack mounts in the new plugin-auth authorized-clients-withdraw.ts. POST /api/v1/auth/authorized-clients/withdraw { id } withdraws a consent of the session user only; POST /api/v1/auth/admin/authorized-clients/withdraw { userId, id } runs the same gateAdmin as GET /admin/authorized-clients before any body read. Both revoke through revokeMcpGrant (the /oauth2/revoke owner: the consent row, then the client's refresh family, via better-auth's adapter, attributed to the withdrawer), so mcpConsentAdmits refuses the token on its next MCP call. Unknown and not-yours give one byte-identical 404 RESOURCE_NOT_FOUND. Ledgered sdk (oauth.authorizedClients.withdraw / withdrawForUser, added to @objectstack/client); better-auth's /oauth2/delete-consent ledgered server-only with the measurement. Measured on @better-auth/oauth-provider 1.7.12: delete-consent DOES check ownership (consent.userId !== session.user.id), so there is no security defect, but it answers unknown 404 and another's 401 (distinguishable) and leaves the refresh family, which is why (a) was not taken. Audit: grant and revoke write no explicit row; plugin-audit's generic writer records the consent create/delete (sys_oauth_consent not in SKIP_OBJECTS), and the withdraw inherits the same generic delete row with no new action value, measured in dogfood with user_id = the withdrawer.",
    "tests": "On head 1c32be06 (main 5210acfb merged): plugin-auth `pnpm --filter @objectstack/plugin-auth test` Test Files 232/232, Tests 4187 passed | 10 skipped; real-plugin + ledger conformance 26/26; client `pnpm --filter @objectstack/client test` 55/55 files, 712/712 (cdf571a0; merge touched no client file), touched client file 8/8 on the final head; plugin-auth + client typecheck exit 0; dogfood after a full pnpm build (119/119): authorized-client-withdraw 2/2, admin-route-nonadmin-refusal + admin-platform-admin-standing 15/15; eslint --no-inline-config on changed .ts exit 0. Ablations via scripts/ablation-replace.mjs against the committed fix, src-resolved suite (plugin-auth tests import ./auth-plugin and ./authorized-clients-withdraw source, no dist): (i) ownership check removed from findConsentOf -> 2 red ('another person's id is refused with the SAME bytes…' expected 200 to be 404; 'a consent that is not the named person's…' expected 200 to be 404), restored blob == HEAD 8835068a7d09, git diff HEAD empty; (ii) gateAdmin removed from the admin withdraw mount -> 1 red ('a member, an organization OWNER…' member: expected 200 to be 403), restored blob == HEAD 61ed5aefa975, git diff HEAD empty.",
    "gates": "node scripts/pm/dispatch-gates.mjs --commands on 1c32be06: 95 derived, 95 run, all exit 0, each with </dev/null and the exit code captured before any pipe; --ran reconciliation: 95 run, 0 NOT-MEASURED, 0 UNRUN (record /mnt/project-files/server-seat-2/r2026-11-06/out/31048-gates-ran-1c32be06.list). First sweep on 9bcc1b5e: check:doc-authoring exit 1 (cloud#3606 in a ledger note string; removed in cdf571a0), check:skill-examples and check:dual-build-cjs-loads exit 3 (no dist before the full build), check-plugin-teardown-shape --self-test exit 3 (shallow clone; pinned fixture commit fetched); all exit 0 on the final sweep. pnpm lint family: eslint --no-inline-config on the changed .ts files exit 0; the repo-wide pnpm lint is CI's. PR check-runs: in_progress at report time.",
    "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
    "mcp_calls": "3 — mcp__github__issue_read (get #31048, get_comments #31048 twice); 0 writes",
    "api_writes": "2 — fleet-write relay pr_create (objectstack-ai/objectstack#31073, read-back identical 11632 bytes); this os-dev-report comment via post-stamped. The harness's assignee/reviewer step was skipped on the frame's rule.",
    "line_budget": "15 files, 991 insertions / 18 deletions vs merge base 23cf11a4 (under 3000; no governed path)",
    "files_changed": "packages/plugins/plugin-auth/src/{authorized-clients-withdraw.ts (new), auth-plugin.ts, auth-route-ledger.ts, auth-route-ledger.conformance.test.ts, authorized-clients-read.ts, authorized-clients-read.real-plugin.test.ts, mcp-token-revocation.ts, auth-manager.ts}; packages/client/src/{index.ts, oauth-authorized-clients.test.ts}; packages/qa/dogfood/test/{authorized-client-withdraw.dogfood.test.ts (new), admin-route-nonadmin-refusal.dogfood.test.ts, admin-platform-admin-standing.dogfood.test.ts}; content/docs/ai/connect-mcp.mdx; .changeset/31048-withdraw-authorized-assistant.md",
    "docs_pages": "No content/docs page listed the authorized-clients doors before this change. One bullet added to content/docs/ai/connect-mcp.mdx, in The security model.",
    "answer_table": "own door: own id 200 { id } | another's id 404 RESOURCE_NOT_FOUND (same bytes as unknown; row stays) | unknown id 404 RESOURCE_NOT_FOUND | a platform admin on the own door with another's id 404 (keyed by session). admin door: platform admin with { userId, id } of that person 200 | id not that person's 404 (same bytes as unknown) | userId naming no user 404 with the admin read's message | non-admin (member, org owner, org admin, the person) 403 PERMISSION_DENIED, byte-identical for existing, missing and empty bodies. Anonymous 401 UNAUTHENTICATED on both. Shape: query param / foreign key / missing, blank or non-string value / non-object 400 VALIDATION_ERROR; unparseable JSON 400 INVALID_REQUEST.",
    "deviations": "Changeset and commit trailers are model-free (Co-authored-by: Claude) per AGENTS.md, which overrides the harness's model-named trailer. Ablations ran on the src-resolved unit suite, not dogfood. The refresh delete is not organization-scoped (inherited from revokeMcpGrant); see Acceptance notes.",
    "open_questions": [],
    "security_findings": "none",
    "out_of_scope_findings": ["carrier: none · noted, not filed — revokeMcpGrant (and so /oauth2/revoke and this withdraw) deletes the client's refresh family across organizations although oauthRefreshToken carries referenceId; a person with the same client granted in two organizations re-authorizes the other organization after a withdraw. Recorded in the PR's Acceptance notes."]
   }