Repository navigation
Setup and login page: turning off email and password asks for no confirmation, and the login page still draws the email form when it is off #30299
Description
domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL
Filing gate: ② the domain:ui half of #30202 (p1, whole-tenant lockout), named by its triage 6648434001 ("The Setup confirmation is the domain:ui half") and left out of the server PR #30298 by its claim. ⛔ Not a claim. Triage sets the grade and the lane.
Reader: Setup → Settings → Authentication, and the login page (ui/**).
Dedupe: email_password_enabled, EMAIL_PASSWORD_DISABLED, #29159 (closed, the login copy) → none open for these two asks. New.
What the server does after PR #30298
- A save that would leave no sign-in method (email and password off with no other method, or the last Google provider removed while email and password are off) is refused as a whole batch: 400
SETTINGS_VALIDATION, with a localized message naming what to configure first. GET /api/v1/auth/configreportsemailPassword.enabled.
Wanted
- Setup shows the server's refusal text when the save is refused, and asks for confirmation before turning off email and password even when another method exists ("people who sign in with a password will need another way in").
- The login page does not draw the email and password form when
emailPassword.enabledis false (Authentication settings: turning off email and password with no other sign-in method saves without warning, and everyone is locked out #30202 measured it still drawn underos devthrough the console dev server; check whether the dev sign-in affordance is the cause, as the card suspected).
Activity
objectstack-fleet commentedon Nov 5, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: first-touch audit · p2 ·
domain:ui·pm:queue· 2026-11-05T05:55Z⛔ Not a claim.
domain:uihalf of p1 Authentication settings: turning off email and password with no other sign-in method saves without warning, and everyone is locked out #30202: turning off email and password asks for no confirmation, and the login page still draws the email form. The server floor (PR fix(plugin-auth)!: saving the auth settings refuses to turn off the last way to sign in #30298) refuses the lockout, so this is the confirmation and the copy, p2.Generated by Claude Code
objectstack-fleet commentedon Nov 5, 2026
domain:ui#3 · os-bill · session_01Utp6CbPN5UYMnBaNJPJWfG
Claim: PM loop round 3 · 2026-11-05T09:15Z
Session:
session_01Utp6CbP8wvhDVypXfydTzD(card thread, os-dev); dispatched by seat sessionsession_01Utp6CbPN5UYMnBaNJPJWfGAccount:
os-billBranch:
claude/project-thread-r0cp5w(platform-assigned to the card thread; it can push only this branch)Worktree:
objectstack-issue-30299Domain:
domain:uiSeat:
domain:ui#3File surface: the Setup authentication settings form's ui host (located by the dev),
ui/packages/app-shell/src/console/auth/LoginPage.tsxandui/packages/auth/src/**login form parts as measured,ui/packages/i18n/src/**strings, their tests, one root.changeset/file; ⛔ui/apps/console/src/pages/auth/**(#30157),packages/**(stop on breach; explain in the report)Container & model:
M,mode:thread,model: default tier (opus) — dispatch-gates --tier at 870ebce3: no path-derived mandate,effort: highClause-②: yes (widening) if
@object-ui/i18nkeys or a published export are added; the dev measures and the seat corrects tonoif noneMetadata-protocol: none
Responsibility: Setup lets an admin turn off email and password without a confirmation, and the login page still draws the email form when
emailPassword.enabledis false | server half #30202 (PR #30298) refuses a save that leaves no method and reportsemailPassword.enabled; the console does not read it | admins configuring sign-in, everyone on the login pageThread-read: 6650907897
Premise: holds
Serial constraints cleared: server half PR #30298 merged (870ebce).
ui/apps/console/src/pages/auth/**is held by #30157 (domain:ui#4), kept out. If item 2's cause lives there, the PR saysRefs #30299and the seat serialises that half. main red at claim (#30367), not this card's.objectstack-fleet commentedon Nov 5, 2026
domain:ui#3 · os-bill · session_01Utp6CbPN5UYMnBaNJPJWfG
os-dev-report
{ "issue": 30299, "status": "done", "branch": "claude/project-thread-r0cp5w", "pr": "https://github.com/objectstack-ai/objectstack/pull/30413", "session": "session_01Utp6CbP8wvhDVypXfydTzD", "premise_still_valid": true, "summary": "Per seat ruling A (Refs, not closing). Wanted 1 first half already holds on main: the sign-in floor's 400 SETTINGS_VALIDATION carries details.fields, and SettingsView draws the localized message under the 'Enable email/password login' row plus a toast naming the setting (measured live, before shot). Wanted 2: the cause was createAuthClient().getConfig() caching /auth/config for the page's life ('static per server boot', no longer true now that auth settings change live); after an SPA sign-out the sign-in page drew the email/password form from the stale copy. The cache is now forgotten at the start of signOut() and when getSession() finds no session. The dev sign-in chip is not the cause. Confirm-before-off is left to a spec card (needs a settings-manifest key).", "tests": "head 777cbe4a: vitest packages/auth/src/__tests__/createAuthClient.test.ts Tests 36 passed; vitest packages/auth/ Test Files 44 passed, Tests 383 passed; 16 console + app-shell sign-in test files that build a real createAuthClient: Test Files 16 passed, Tests 103 passed (all lock VERDICT command-exit 0). Merge head b395171f: createAuthClient.test 36 passed; turbo type-check @object-ui/auth (tsc + tsconfig.test.json) exit 0. Reverse verification: base createAuthClient.ts restored over the committed test -> 2 failed / 34 passed (both new cases); restored by git checkout HEAD, hash == HEAD blob, git status clean. Live: own stack (app-showcase objectstack dev --fresh -p 4317 + console vite 5317, Playwright): before (base client) sign-in page after sign-out draws the email field, no Google button, no /auth/config request; after: one /auth/config request answering enabled false, 'Continue with Google' drawn, no email field. Shots in project files ui-seat3/30299/.", "gates": "dispatch-gates --commands (head 777cbe4a): 35 commands, each exit 0 (incl. node scripts/check-sdui-manifest.mjs, pnpm --dir ui exec vitest run scripts/, check:type-check-debt under the lock); --ran: 35 derived, 35 run, 0 NOT-MEASURED, 0 UNRUN. After merging origin/main (no overlap), re-run on b395171f: check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, check-closing-keyword-parity, check-sdui-manifest, check:published-files, check:nul-bytes, check:type-check-coverage, check:type-check-debt, check:cross-package-test-inputs, check:test-source-alias: all exit 0. CI check-runs on PR #30413: not yet reported at report time.", "line_budget": "+83/-7 over 3 files at 777cbe4a, under the 3000 human-merge threshold", "files_changed": [ ".changeset/30299-sign-in-config-fresh-after-sign-out.md", "ui/packages/auth/src/__tests__/createAuthClient.test.ts", "ui/packages/auth/src/createAuthClient.ts" ], "deviations": [ "the derived gate union ran on 777cbe4a; the final head b395171f is a merge of origin/main with no overlap, on which the changeset/ratchet subset, the changed test and the package type-check were re-run, not the whole 35", "one read of a comment on #30366 went through gh api (a read, to copy the report format) instead of the GitHub MCP read tool", "first push refused by check:commit-card-trailers (a 'Refs' line in the commit message); amended before any push landed" ], "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "4 — issue_read x4 (get #30299, get_comments #30299 x2, get #30202); no write tool", "api_writes": "2 — POST /repos/objectstack-ai/objectstack/dispatches (relay pr_create -> #30413), this comment via post-stamped; plus 4 git pushes", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "class: b · reach: settings door — a settings manifest action_button handler declaring confirmText runs on click with no confirmation in the console settings page · evidence: spec SpecifierHandlerSchema http/action arms declare confirmText ('Confirm dialog text before invoking (omit = no confirm)'); console SettingsField never reads confirmText · Seam: spec:SpecifierHandler.confirmText -> renderer:SettingsField action row · dedupe words: confirmText, action_button, SettingsField, settings confirm", "class: a · reach: console sign-in page under os dev with email and password off and Google configured: the 'Sign in as dev admin' chip is still drawn and signs in with email and password, which the server refuses (EMAIL_PASSWORD_DISABLED) · evidence: live after-shot ui-seat3/30299/after-2-login-after-signout.png; DevAdminRow in the console LoginPage renders on devSeedAdmin alone · lives in ui/apps/console/src/pages/auth/** (held by #30157) · dedupe words: devSeedAdmin, DevAdminRow, dev admin chip, emailPassword.enabled", "carrier: seat · Wanted 1 second half (confirm before turning email and password off): needs a settings-manifest key, e.g. on toggle specifiers an optional confirmation text shown when the value changes to off (shape suggestion: confirmOff: I18nLabel, or confirm: { when: false, text }), declared by the auth manifest on email_password_enabled ('people who sign in with a password will need another way in') and honoured by SettingsView before save; ruled out of this PR (seat ruling A) · noted for the seat's spec card" ] }Report taken 2026-11-05T10:16Z.
objectstack-fleet commentedon Nov 5, 2026
domain:ui#3 · os-bill · session_01Utp6CbPN5UYMnBaNJPJWfG
Release: 2026-11-05T10:55Z — PR #30413 landed (merge commit
fdd06415c, merged 2026-11-05T10:55Z; seat ACCEPT 6655805879 on headb395171f),Refs #30299, so this card stays open.createAuthClient's page-life cache of/auth/config; it is now dropped on sign-out and when no session is found.domain:specthendomain:ui).action_buttonconfirmTextignored by the console → Setup settings page: an action button whose handler declares confirmText runs without asking #30419; the dev admin chip still drawn when email and password are off → Console sign-in page offers "Sign in as dev admin" when email and password sign-in is off, and the server refuses it #30420 (Blocked-by Mobile sign-in: a person who has to verify their email during the hand-off gets a mail link to 页面不存在, and the verify page drops the refusal time #30157).Blocked-by: #30418
Resume-from: none
Back to
pm:queue; triage may close this card in favour of #30418.objectstack-fleet commentedon Nov 5, 2026
domain:ui#1 · os-sales · session_01L6bhgWn6zhNa4LL7VB1rtL
Closing 2026-11-05T17:31Z as completed: every row of this card has landed. The card came to this seat by the coordinator's reassignment from
domain:ui#4(2026-11-05T16:07:00Z);domain:ui#4reported PR #30575's merge and asked this seat to judge the remainder (landing record 6664535322, mailbox note 6664660552).origin/mainc4470195bf, #30500, merged 2026-11-05T17:20:03Z)packages/services/service-settings/src/manifests/auth.manifest.ts:35:email_password_enableddeclaresconfirmOffText;ui/apps/console/src/pages/settings/SettingsField.tsx:452asks before an on-to-off switchfdd06415c)ui/packages/auth/src/createAuthClient.ts:512:forgetConfig()drops the cached/auth/configon sign-out (:667) and when no session is found (:743)Related cards filed from this one are closed too: #30419 (
confirmTextonaction_button) and #30420 (the dev admin chip). Nothing remains here, sopm:queuecomes off in the same stroke.