test(auth): cover the better-auth 2FA lockout path; regenerate object translation bundles (#3624 follow-up) (#3659)

os-zhuang · claude · web-flow · commit 9aa55100c45e · 2026-07-27T21:30:21.000+08:00
* test(auth): cover the better-auth 2FA lockout path; regenerate object translation bundles (#3624 follow-up) Follow-up to #3647, which provisioned four better-auth 1.7 columns that no platform object had. Two loose ends from that PR. ## The 2FA lockout path had no test at all `sys_two_factor.failed_verification_count` / `locked_until` were added blind alongside the team fix — found by the new parity gate, not by anything exercising the behavior. That is why they went missing in the first place: the whole path was untested, so a column better-auth writes on every wrong code could vanish without a single failure. The new dogfood test pins the behavior, not just the schema: a wrong code is COUNTED (the counter advances in the database), and a correct code RESETS the count — which is what makes the budget track *consecutive* failures. It has to go through the mid-sign-in two-factor cookie, not a bearer token: better-auth only runs `assertTwoFactorNotLocked` / `recordTwoFactorFailure` when `isSignIn` is true, and deliberately skips both when the same endpoint is called with a live session. A bearer-token test would have passed while the lockout path stayed entirely unexercised — the exact blind spot that let the columns through. Reverting the `AUTH_TWO_FACTOR_SCHEMA` mapping makes it fail, and shows the breakage was wider than the wrong-code path: `two-factor/enable` itself 500s with `table sys_two_factor has no column named failedVerificationCount`, so enrollment was broken too. TOTP is generated in-test from the otpauth:// secret via RFC 6238 over node:crypto rather than importing `@better-auth/utils/otp` — that is a transitive dependency, and taking a direct one on it to produce six digits would tie the test to an internal package's resolution. ## Translation bundles `os i18n extract` regenerated for the four new fields, which were absent from every locale bundle. Also picks up `sys_organization.parent_organization_id` / `sort_order` from the earlier ADR-0105 D6 work, which had the same gap. The `*.metadata-forms.generated.ts` bundles are deliberately NOT included: the same run rewrites them with unrelated spec drift (agent `visibility` and `capabilities.trash`/`mru` removed, `summaryOperations.*` added). Those are DELETIONS of curated translations for a spec change this branch has nothing to do with, so they are left for whoever owns that change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UYLC8TfjzHGwatNxZKdX7H * chore(changeset): declare the object-translation bundle update (#3624 follow-up) The regenerated bundles ship inside @objectstack/platform-objects, so the change is consumer-visible and takes a real patch changeset rather than an empty one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UYLC8TfjzHGwatNxZKdX7H --------- Co-authored-by: Claude <noreply@anthropic.com>
diff --git a/.changeset/two-factor-lockout-and-object-translations.md b/.changeset/two-factor-lockout-and-object-translations.md
@@ -0,0 +1,19 @@
+---
+"@objectstack/platform-objects": patch
+---
+
+fix(i18n): ship the missing object-translation keys for the better-auth 1.7 and ADR-0105 D6 fields (#3624 follow-up)
+
+The generated object-translation bundles predate two rounds of field additions,
+so six fields had no entry in **any** locale and fell back to their raw schema
+labels in every UI surface that reads the bundle:
+
+- `sys_team.member_count`, `sys_team_member.membership_key`,
+  `sys_two_factor.failed_verification_count` / `locked_until` — the better-auth
+  1.7 columns provisioned in #3647.
+- `sys_organization.parent_organization_id` / `sort_order` — the same gap left
+  by the earlier ADR-0105 D6 group-structure work.
+
+Regenerated with `os i18n extract` (merge mode, so every existing translation is
+preserved — the diff is purely additive). No API or schema change; the fields
+themselves already shipped.
diff --git a/packages/platform-objects/src/apps/translations/en.objects.generated.ts b/packages/platform-objects/src/apps/translations/en.objects.generated.ts
@@ -507,6 +507,14 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "Require Multi-Factor Auth",
         help: "When true, every member of this organization must enroll an authenticator app to access data."
       },
+      parent_organization_id: {
+        label: "Parent Organization",
+        help: "Reporting/grouping parent. Grants NOTHING — visibility across organizations comes from membership, never from this reference (ADR-0105 D6)."
+      },
+      sort_order: {
+        label: "Sort Order",
+        help: "Display order among sibling organizations. Presentation only."
+      },
       id: {
         label: "Organization ID"
       },
@@ -709,6 +717,10 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "Organization",
         help: "Parent organization for this team"
       },
+      member_count: {
+        label: "Member Count",
+        help: "Seat counter maintained by better-auth; do not write directly."
+      },
       id: {
         label: "Team ID"
       },
@@ -759,6 +771,10 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       user_id: {
         label: "User"
+      },
+      membership_key: {
+        label: "Membership Key",
+        help: "Derived membership digest maintained by better-auth; do not write directly."
       }
     },
     _actions: {
@@ -993,6 +1009,14 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       verified: {
         label: "Verified",
         help: "Whether the enrollment was confirmed with a valid TOTP code (managed by better-auth)"
+      },
+      failed_verification_count: {
+        label: "Failed Verification Count",
+        help: "Consecutive failed 2FA verifications; reset on success. Maintained by better-auth."
+      },
+      locked_until: {
+        label: "Locked Until",
+        help: "Set when failed 2FA verifications cross the lockout threshold. Maintained by better-auth."
       }
     },
     _views: {
diff --git a/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts b/packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts
@@ -507,6 +507,14 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         label: "Exigir autenticación multifactor",
         help: "Si es true, todos los miembros de esta organización deben registrar una aplicación de autenticación para acceder a los datos."
       },
+      parent_organization_id: {
+        label: "Parent Organization",
+        help: "Reporting/grouping parent. Grants NOTHING — visibility across organizations comes from membership, never from this reference (ADR-0105 D6)."
+      },
+      sort_order: {
+        label: "Sort Order",
+        help: "Display order among sibling organizations. Presentation only."
+      },
       id: {
         label: "ID de organización"
       },
@@ -709,6 +717,10 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         label: "Organización",
         help: "Organización principal de este equipo."
       },
+      member_count: {
+        label: "Member Count",
+        help: "Seat counter maintained by better-auth; do not write directly."
+      },
       id: {
         label: "ID de equipo"
       },
@@ -759,6 +771,10 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       user_id: {
         label: "Usuario"
+      },
+      membership_key: {
+        label: "Membership Key",
+        help: "Derived membership digest maintained by better-auth; do not write directly."
       }
     },
     _actions: {
@@ -993,6 +1009,14 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       verified: {
         label: "Verified",
         help: "Whether the enrollment was confirmed with a valid TOTP code (managed by better-auth)"
+      },
+      failed_verification_count: {
+        label: "Failed Verification Count",
+        help: "Consecutive failed 2FA verifications; reset on success. Maintained by better-auth."
+      },
+      locked_until: {
+        label: "Locked Until",
+        help: "Set when failed 2FA verifications cross the lockout threshold. Maintained by better-auth."
       }
     },
     _views: {
diff --git a/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts b/packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts
@@ -507,6 +507,14 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
         label: "多要素認証を必須化",
         help: "true の場合、この組織のすべてのメンバーはデータにアクセスするために認証アプリの登録が必要になります。"
       },
+      parent_organization_id: {
+        label: "Parent Organization",
+        help: "Reporting/grouping parent. Grants NOTHING — visibility across organizations comes from membership, never from this reference (ADR-0105 D6)."
+      },
+      sort_order: {
+        label: "Sort Order",
+        help: "Display order among sibling organizations. Presentation only."
+      },
       id: {
         label: "組織 ID"
       },
@@ -709,6 +717,10 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
         label: "組織",
         help: "このチームの親組織"
       },
+      member_count: {
+        label: "Member Count",
+        help: "Seat counter maintained by better-auth; do not write directly."
+      },
       id: {
         label: "チーム ID"
       },
@@ -759,6 +771,10 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       user_id: {
         label: "ユーザー"
+      },
+      membership_key: {
+        label: "Membership Key",
+        help: "Derived membership digest maintained by better-auth; do not write directly."
       }
     },
     _actions: {
@@ -993,6 +1009,14 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       verified: {
         label: "Verified",
         help: "Whether the enrollment was confirmed with a valid TOTP code (managed by better-auth)"
+      },
+      failed_verification_count: {
+        label: "Failed Verification Count",
+        help: "Consecutive failed 2FA verifications; reset on success. Maintained by better-auth."
+      },
+      locked_until: {
+        label: "Locked Until",
+        help: "Set when failed 2FA verifications cross the lockout threshold. Maintained by better-auth."
       }
     },
     _views: {
diff --git a/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts b/packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts
@@ -507,6 +507,14 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
         label: "强制多因素认证",
         help: "为 true 时，该组织的每位成员都必须注册身份验证器 App 才能访问数据。"
       },
+      parent_organization_id: {
+        label: "Parent Organization",
+        help: "Reporting/grouping parent. Grants NOTHING — visibility across organizations comes from membership, never from this reference (ADR-0105 D6)."
+      },
+      sort_order: {
+        label: "Sort Order",
+        help: "Display order among sibling organizations. Presentation only."
+      },
       id: {
         label: "组织 ID"
       },
@@ -709,6 +717,10 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
         label: "组织",
         help: "该团队所属的上级组织"
       },
+      member_count: {
+        label: "Member Count",
+        help: "Seat counter maintained by better-auth; do not write directly."
+      },
       id: {
         label: "团队 ID"
       },
@@ -759,6 +771,10 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       user_id: {
         label: "用户"
+      },
+      membership_key: {
+        label: "Membership Key",
+        help: "Derived membership digest maintained by better-auth; do not write directly."
       }
     },
     _actions: {
@@ -993,6 +1009,14 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       verified: {
         label: "Verified",
         help: "Whether the enrollment was confirmed with a valid TOTP code (managed by better-auth)"
+      },
+      failed_verification_count: {
+        label: "Failed Verification Count",
+        help: "Consecutive failed 2FA verifications; reset on success. Maintained by better-auth."
+      },
+      locked_until: {
+        label: "Locked Until",
+        help: "Set when failed 2FA verifications cross the lockout threshold. Maintained by better-auth."
       }
     },
     _views: {
diff --git a/packages/qa/dogfood/test/two-factor-lockout.dogfood.test.ts b/packages/qa/dogfood/test/two-factor-lockout.dogfood.test.ts
