feat(console): make delegated_admin reachable and narrow both role pickers (framework#3697) - #2891
Merged
Merged
Conversation
…pickers (framework#3697) The framework registered a fourth organization role — `delegated_admin`, the grade that may reach `/organization/invite-member` WITHOUT being an org admin, which is what finally gives ADR-0105 D8's scope-bounded issuance gate a caller. #2868 already shipped the placement half of this UX, but the console could not select the role at all: `MembersPage` and `InviteMemberDialog` each inlined `type Role = 'owner' | 'admin' | 'member'`, so the capability the framework grew was unreachable from either screen. One vocabulary, not two. Role names, labels and narrowing rules now live in `@object-ui/auth`'s new `org-roles` module and both screens consume it. The list still MIRRORS the server rather than deriving from it — `/auth/config` publishes feature flags but no role vocabulary — so the module says so and points at objectstack-ai/objectstack#3723, which tracks making one list the source for all of them. Both pickers now narrow to what the server will accept, the way the placement picker already does. They mirror DIFFERENT gates: - invite role ← `beforeCreateInvitation`'s role cap: never above the issuer's own grade; a below-admin issuer may invite as `member` only. A `delegated_admin` picking "Admin" would have 403'd; it is no longer offered. - change role ← better-auth's `update-member-role`: needs `member:["update"]` (owner/admin only), and only an owner may set `owner` or re-role an existing owner. An actor who may re-role nobody gets no items rather than three that would 403. Narrowing is convenience, not the boundary — the server re-checks — and it fails toward less: an unresolved membership offers `member` alone on invite, nothing on re-role. An ordinary invitation's request body is byte-identical to before. The existing placement test mocked `@object-ui/auth` wholesale; it now spreads `importActual` so the narrowing helpers under test are the real ones. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015s4qPrCKBvVwmFeSsFHgNp
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
✅ Console Performance Budget
📦 Bundle Size Report
Size Limits
|
os-zhuang
marked this pull request as ready for review
July 28, 2026 03:44
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-on to objectstack-ai/objectstack#3722 (merged), which registered a fourth organization role. Companion to #2868, which shipped the placement half of this UX.
The gap
objectstack-ai/objectstack#3722 gave ADR-0105 D8's scope-bounded issuance gate its missing caller:
delegated_admin, the membership grade that may reach/organization/invite-memberwithout being an org admin. #2868 already narrows the unit/position pickers withdescribeDelegableScope().But the console couldn't select the role in the first place —
MembersPage.tsxandInviteMemberDialog.tsxeach inlined:So the capability the framework grew was unreachable from either screen. Provisioning a delegate today requires a raw API call — I had to
curl/organization/update-member-roleto browser-verify the framework side at all.One vocabulary, not two
Role names, labels and narrowing rules move into
@object-ui/auth's neworg-rolesmodule (ORG_ROLES,ORG_ROLE_LABELS,orgRoleGrade,invitableOrgRoles,assignableOrgRoles); both screens consume it.Honest caveat, stated in the module itself: this list still mirrors the server rather than deriving from it.
/auth/configpublishes feature flags but no role vocabulary, so there is no surface to read — objectstack-ai/objectstack#3723 tracks making one list the source for all of them (the framework already carries the same list twice: the better-auth roles map and two enforcedField.selectoption sets; this is the third). Until that lands, a server-side role addition means one console edit instead of two.Both pickers now narrow — mirroring different server gates
Same property #2868 established for placement: narrows, does not decide. The server re-checks; the only failure the console can cause is proposing something that then 403s.
beforeCreateInvitationrole capmemberonlyupdate-member-roleroutemember:["update"](owner/admin only —delegated_adminis built frommemberAcand holdsmember: []); only an owner may setowneror re-role an existing ownerConcretely: a
delegated_adminwho picked "Admin" was heading for a 403 from the framework's role cap — that option is simply no longer offered. An actor who may re-role nobody now gets no menu items instead of three that would fail.Fails toward less: an unresolved membership offers
memberalone on invite, and nothing on re-role. An ordinary invitation's request body is byte-identical to before.Changes
packages/auth/src/org-roles.tspackages/auth/src/index.ts.../manage/InviteMemberDialog.tsxinvitableOrgRoles(activeMember?.role).../manage/MembersPage.tsxassignableOrgRoles(activeMember?.role, member.role).../__tests__/InviteMemberDialog.placement.test.tsx@object-ui/authmock now spreadsimportActual, so the helpers under test are the real ones rather than mocked awayVerification
packages/auth/src/__tests__/org-roles.test.ts— grade ladder, both narrowing rules, and the fail-closed floor for each.packages/app-shell/.../InviteMemberDialog.roleCap.test.tsx— owner sees all four; admin gets the delegate grade but not owner; a delegate seesmemberonly (the escalation chain has no UI entry); an unloaded membership still allows the ordinary invite; the narrowed default still submits an unchanged payload.turbo linton both packages: 0 errors (warnings are the repo's pre-existing baseline).turbo build(tsc): 29/29 successful.Note for translators
organization.roles.*has never been defined in any locale bundle — all four labels (owner/admin/member included) resolve through theirdefaultValueEnglish fallback. The new role follows the same pattern rather than becoming the only localized one. Localizing the set is a separate, deliberate change.Generated by Claude Code