docs(adr): ADR-0092 修订 — D2 通用化为 registry 驱动的身份表写守卫#2808
Merged
Conversation
… write guard Review feedback on the merged first draft (#2787): the raw-write hole that D2 closes is not sys_user-specific — every managedBy:'better-auth' table relies on the same deny-by-permission-set + hide-by-affordance combination, so admin_full_access can raw-write sys_member/sys_session/ sys_api_key rows through the generic data API just the same. Revision keeps the sys_user field-tier decision (D1) unchanged and generalizes the mechanism: - D2 is now a generic before{Insert,Update,Delete} guard keyed off the schema registry's managedBy flag (no hardcoded table list), default- deny for user-context writes across the whole identity family, with a per-object update whitelist as the only opening — sys_user {name, image} is the first entry - sys_user-only guard recorded under Alternatives as superseded - risks + rollout updated accordingly (call-site sweep before merge, guard tests per table) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
os-zhuang
marked this pull request as ready for review
July 11, 2026 01:33
This was referenced Jul 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
按维护者评审意见修订 ADR-0092（首版 #2787 已合并）：守卫机制从 sys_user 单表通用化为覆盖整个
managedBy: 'better-auth'家族。仍为文档-only，状态保持 Proposed。修订动机
首版调研发现的裸写漏洞（
admin_full_access可经 data API 直写任意列）对全部 11 张身份表成立，不只sys_user—— 平台管理员今天同样可以裸插sys_member行（自授组织成员身份）、裸改sys_api_key、裸删sys_session，全部绕过 better-auth 的副作用。首版 D2 只堵了一张表；逐表复制守卫正是"第十二张表裸奔上线"的路径。修订内容
before{Insert,Update,Delete}守卫按 schema registry 的managedBy标志判定（无硬编码表清单），对全家族的用户上下文写入默认拒绝；唯一开口是按对象注册的 update 白名单（registerManagedUpdateWhitelist），首个条目sys_user → {name, image}。内部写入（better-auth adapter、isSystem）照旧直通。sys_organization.name"只是一行白名单注册引用本 ADR，无需新 ADR。D1 / D3–D6（字段分层、白名单同源派生、affordance 时序、权限拓扑、会话缓存失效）均保持首版不变。
相关
🤖 Generated with Claude Code
https://claude.ai/code/session_01YGAN5VvvBi4YRGwpNT6e21
Generated by Claude Code