fix(auth): make the SSO Providers list visible to admins (ADR-0024 / cloud#551)#2394
Merged
Conversation
…cloud#551) The sys_sso_provider Setup list rendered empty even after an admin registered a provider — member_default's wildcard tenant_isolation RLS denied every row (better-auth writes via its adapter with no tenantId → organization_id never stamped; the platform-admin viewAllRecords bypass is gated to private/non-tenant objects). sys_sso_provider is env-global admin-only identity config, so it now declares tenancy.enabled:false (admin viewAllRecords sees all env providers) + requiredPermissions:['manage_platform_settings'] (object-level gate so members are 403'd; without it tenancy-disabled + member_default '*' allowRead would leak). Verified E2E: admin sees all providers in the list, non-admin → 403. Env-only object (no control-plane risk). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 3 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
After an admin registers an external IdP, the Setup → Access Control → SSO Providers list rendered empty.
member_default's wildcardtenant_isolationRLS (organization_id == current_user.organization_id) denied every row — better-auth writessys_sso_providervia its adapter with no tenantId context, soorganization_idis never stamped, and the platform-adminviewAllRecordssuperuser bypass is gated to private/non-tenant objects.What
sys_sso_provideris env-global, admin-only identity config, so it now declares:tenancy: { enabled: false }— opts out of multi-tenancy (the env IS the tenant; providers are env-wide), so a platform admin'sviewAllRecordsbypass sees every provider.requiredPermissions: ['manage_platform_settings']— object-level capability gate so ordinary members are denied (without it, tenancy-disabled +member_default's'*': allowReadwould leak providers to every authenticated user — I verified that leak before adding this).Verification (browser E2E)
total=1, the registeredglrow renders); register form still works.403 'requires capability [manage_platform_settings]'.Env-only object (no control-plane cross-tenant impact). The sibling
sys_oauth_application/sys_accountnav entries share the same empty-list symptom but span the control plane — separate per-object follow-up.🤖 Generated with Claude Code