Skip to content

auth: ORG_ROLE_LABELS has no external entry, so after objectstack#25233 stage 1 adds the role to BUILTIN_MEMBERSHIP_ROLES the console no longer type-checks — objectstack Console Pin Gate and Spec Shape Gate are red #13427

Closed
#13429
objectstack-ai/objectstack
#25546
Closed
auth: ORG_ROLE_LABELS has no external entry, so after objectstack#25233 stage 1 adds the role to BUILTIN_MEMBERSHIP_ROLES the console no longer type-checks — objectstack Console Pin Gate and Spec Shape Gate are red#13427
#13429
objectstack-ai/objectstack
#25546
Assignees
os-sales
Labels
area:identityLogin and identity — sign-up, sessions, organization membership, SSObugSomething isn't workingdomain:uiobjectui ui stream: fix lands on the published library or apps — objectui execution seatpriority:p1

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 23, 2026

维护者速读

  • 事由： objectstack 19:02 合入的「外部组织角色」（objectstack#25233 第一阶段，PR #25515）在协议的内置成员角色里新增了 external。objectui packages/auth/src/org-roles.ts 的 ORG_ROLE_LABELS 是按角色写全的表，少了这一项，控制台因此编译失败。objectstack 主干的 Console Pin Gate 和 Spec Shape Gate 两个检查都红了。
  • 要做： 补上 external 的标签项和各语言翻译，并按 #25233 的裁决确认这个角色在各处的显示和权限档位。
  • 完成标准： objectui 对着 objectstack 当前 main 能通过类型检查；之后 objectstack 换 objectui 版本，两个检查转绿。

Filing gate ① a measured defect that keeps objectstack main red. Filed by the objectstack triage seat (session_01AavokzJ5DndAwitDXvKy4U, R618). ⛔ Not a claim.

Grade: p1: the objectstack main-red fix, and it blocks the 18.1.0 cut. domain:ui, area:identity, bug.

Measured

  • objectstack hourly CI 40015953606 on 1ff43b67ea (20:01Z): Console Pin Gate failed at "Build the Console SPA at the pinned objectui SHA". The error is in packages/auth, pnpm run build:

    Property 'external' is missing in type '{ owner …; admin …; delegated_admin …; member … }' but required in type 'Record<"admin" | "member" | "external" | "owner" | "delegated_admin", …>'.

  • objectstack Spec Shape Gate 40014906665 (19:53Z) reports the same error: TS2741 at packages/auth/src/org-roles.ts:67:14, compiled against @objectstack/spec built from objectstack main.
  • The cause is objectstack 9019af9fe6, "feat(security): an external organization role" (#25515), which touches packages/spec/src/identity/membership-role.ts. The last green hourly run was 19:01Z on aa2dbab7b6.

Landing (objectui origin/main)

  • packages/auth/src/org-roles.ts: ORG_ROLE_LABELS: Record<OrgRole, …> (~:67) needs an external entry, for example organization.roles.external. Add the key to every shipped locale pack.
  • Read objectstack#25233's ruling (letter B) before choosing the rest. ORG_ROLES is [...BUILTIN_MEMBERSHIP_ROLES], so external now appears wherever the console lists roles, including the invite and role pickers. Also choose where it sits on the grade ladder (~:80). Fail-closed reads it as no higher than member, since an external member reaches data only through explicit grants. Report those two choices.
  • Any other exhaustive Record<OrgRole, …> or switch over the role type gets the same treatment. The type check finds them.

Done when

Size: S.

Dedupe

The objectui issues and PRs updated since 2026-10-23T19:00Z, matched on external, org-roles and role: none. New.

Generated by Claude Code

Activity

  1. objectstack-fleet
    added
    bugSomething isn't working
    pm:queue
    domain:uiobjectui ui stream: fix lands on the published library or apps — objectui execution seat
    priority:p1
    area:identityLogin and identity — sign-up, sessions, organization membership, SSO
    pm:dispatched
    and removed
    pm:queue
    on Oct 23, 2026
  2. objectstack-fleet
    assigned
    os-sales
    on Oct 23, 2026

  3. objectstack-fleet commented on Oct 23, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 23, 2026
    ContributorAuthor

    Claim: PM loop · 2026-10-23T21:19Z
    Session: session_01JtDJkBUiZnD9NWnDqYuhq7 (the card thread, dispatched by this project's coordinator for domain:ui seat 1)
    Account: os-sales (the seat's linked user; the card's assignee)
    Branch: claude/issue-13427-external-role-label
    Worktree: objectui-issue-13427
    Domain: domain:ui
    Seat: domain:ui#1
    File surface: packages/auth/src/org-roles.ts and packages/auth/src/__tests__/org-roles.test.ts; the organization.roles block of each shipped pack in packages/i18n/src/locales/; the organization screens' tests the vocabulary reaches (packages/app-shell/src/console/organizations/__tests__/); .objectstack-sha and the packed manifests in .objectstack-pin/ (written by scripts/bump-objectstack.sh, none by hand), moved to an objectstack main commit that carries objectstack#25515, because the fix imports the spec's MEMBERSHIP_ROLE_EXTERNAL instead of spelling it; pnpm-lock.yaml only if the install rewrites it; one changeset (stop on breach; explain in the report)
    Container & model: S, mode:thread, model: default, effort: xhigh (p1)
    Clause-②: yes (follows objectstack#25515's widening: a new ORG_ROLE_EXTERNAL export and ORG_ROLE_LABELS row in @object-ui/auth, and a new organization.roles.external key in each shipped pack; no acceptance set of objectui's own widens)
    Metadata-protocol: none
    Ruling-ref: objectstack#25233 ruling of record 6355206139, letter B (with E3: any issuer that reaches the invitation endpoint may confer external)
    Responsibility: objectstack main is red (Console Pin Gate, Spec Shape Gate) | ORG_ROLE_LABELS is exhaustive over the spec vocabulary and objectstack#25515 added external | the 18.1.0 cut waits on objectstack#25537, which is Blocked-by: this card
    Thread-read: none
    Serial constraints cleared: the 7 open objectui PRs (#13362, #13360, #13358, #13289, #13028, #11845, #11844) touch none of the files above (read in this act); the pin move passes objectstack#25483 (objectstack#25251's PR1), which any pin carrying #25515 must; objectui consumes the pin by commit, so the move cuts no objectstack release.

    由Sales账户的项目负责

    Generated by Claude Code

  4. objectstack-fleet
    closed this as completedin #13429on Oct 23, 2026

  5. objectstack-fleet commented on Oct 23, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 23, 2026
    ContributorAuthor

    LANDED

    objectui#13427 由 PR objectui#13429 合入 main，合并提交 2958f17e9c6add35636bb07aa9da4b1dcb1daa5f（2026-10-23T22:12Z，经合并队列）。记录于 2026-10-23T22:13Z。

    Seat: domain:ui#1

    落地内容：控制台认识 objectstack#25515 新增的 external 组织角色：@object-ui/auth 导出 ORG_ROLE_EXTERNAL 并带标签（中文「外部成员」），admin 以下的邀请人也可按服务端规则邀请为外部成员；objectui 对着 objectstack main 重新能编译。pin 保持在 915e9404。下一步由 objectstack#25537 移 .objectui-sha。

    撤下 pm:dispatched。席位核对见 PR comment 6375586665。

  6. objectstack-fleet
    removed
    pm:dispatched
    on Oct 23, 2026

  7. os-zhuang commented on Oct 23, 2026

    @os-zhuang
    os-zhuang
    on Oct 23, 2026
    Contributor

    本 issue 在本次合并之前就已经是 closed 状态，这里只补上修复它的 PR：objectstack-ai/objectstack 的 https://github.com/objectstack-ai/objectstack/pull/25546。本工作流没有改动它的状态。

    （跨仓库的关闭关键字不会自动生效，本条由 cross-repo-issue-closer 工作流代为收口。）

    Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:identityLogin and identity — sign-up, sessions, organization membership, SSObugSomething isn't workingdomain:uiobjectui ui stream: fix lands on the published library or apps — objectui execution seatpriority:p1

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions