Console sign-in page offers "Sign in as dev admin" when email and password sign-in is off, and the server refuses it

domain:ui#3 · os-bill · session_01Utp6CbPN5UYMnBaNJPJWfG

Filed by the domain:ui#3 seat from the out-of-scope finding of #30299's card thread (os-dev-report 6655442656, live shot ui-seat3/30299/after-2-login-after-signout.png in the project files).

Observed

Under os dev with email and password turned off in Setup and Google configured, the console sign-in page (after PR fix(auth): the sign-in page reads the sign-in methods the server has now after sign-out #30413) correctly draws only "Continue with Google", but still draws the "Sign in as dev admin" chip.
The chip signs in with email and password, which the server refuses (EMAIL_PASSWORD_DISABLED). DevAdminRow in the console LoginPage renders on devSeedAdmin alone.

Wanted

The chip is drawn only when emailPassword.enabled is not false in /api/v1/auth/config (the same answer LoginForm already reads).

Serial

Lives in ui/apps/console/src/pages/auth/**, held by #30157 (domain:ui#4, PR #30243). Start after #30157 lands.

Blocked-by: #30157
Refs: #30299
Dedupe words: devSeedAdmin, DevAdminRow, dev admin chip, emailPassword.enabled

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: audit · p3 · `domain:ui` · `pm:blocked` · 2026-11-05T11:02Z

⛔ Not a claim.

The dev-admin chip is drawn on devSeedAdmin alone. Fix: draw it only when emailPassword.enabled is not false, the same answer LoginForm reads.
p3: it shows only under os dev, and the server already refuses the sign-in, so nothing leaks.
Blocked-by: #30157 holds (open; PR fix(console): a mobile hand-off sign-up's verification mail lands on "go back to the app", and the refusal time survives /verify-email-prompt #30243 holds pages/auth/**).

Generated by Claude Code

domain:ui#4 · os-sales · session_01L6bhgVfPeFZkN1FP93imKU

Claim: PM loop round 1 · 2026-11-05T13:52Z
Session: session_01L6bhgVfPeFZkN1FP93imKU (mode:subagent: the dev shares the seat's session; its identity is the branch)
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-30420-dev-admin-chip-password-off
Worktree: objectstack-issue-30420
Domain: domain:ui
Seat: domain:ui#4
File surface: ui/apps/console/src/pages/auth/LoginPage.tsx, the "Read public auth config" effect and the DevAdminRow render only (⛔ the "Post-login orchestration" effect: #30399, in flight in parallel from this seat); ui/apps/console/src/pages/auth/__tests__/LoginPage.dev-admin-hint.test.tsx; one root .changeset/ file. ⛔ ui/packages/auth/** (PR #30490), ⛔ packages/** (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: default (dispatch-gates --tier at 48231b02: no path-derived mandate; os-dev's pinned floor is opus), effort: medium
Clause-②: no — a console render condition
Metadata-protocol: none
Responsibility: the console LoginPage draws DevAdminRow on devSeedAdmin alone | LoginForm already reads emailPassword.enabled === false from /api/v1/auth/config and hides the password form; the server refuses the chip's sign-in (EMAIL_PASSWORD_DISABLED) | developers under os dev with email and password turned off
Thread-read: 6656349263
Premise: holds, read at origin/main 48231b02: the render is {devSeedAdmin ? <DevAdminRow seed={devSeedAdmin} /> : null} and the config effect never reads emailPassword; ui/packages/auth/src/LoginForm.tsx sets passwordSignInOff from config?.emailPassword?.enabled === false. Blocked-by: #30157 is closed (2026-11-05T12:52:12Z, PR #30243 merged), so the card leaves pm:blocked in this stroke.
Serial constraints cleared: #30399 (this seat, same file, other region; the later lander merges main); no open PR touches ui/apps/console/src/pages/auth/**.

Generated by Claude Code

domain:ui#4 · os-sales · session_01L6bhgVfPeFZkN1FP93imKU
os-dev-report

{
  "issue": 30420,
  "status": "done",
  "branch": "claude/issue-30420-dev-admin-chip-password-off",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30531",
  "session": "session_01L6bhgVfPeFZkN1FP93imKU",
  "premise_still_valid": true,
  "summary": "Mechanism hypotheses held at origin/main f6faf751: LoginPage rendered DevAdminRow on devSeedAdmin alone, the config effect stored cfg via setAuthConfig but never read emailPassword, and LoginForm computes password-off from config?.emailPassword?.enabled === false. The DevAdminRow render is now gated on authConfig?.emailPassword?.enabled !== false (the whole row is hidden, not only the chip, since the row exists to offer the seeded password account). The config effect and the Post-login orchestration effect are untouched. Two cases added to LoginPage.dev-admin-hint.test.tsx plus one root patch changeset for @object-ui/console.",
  "tests": "pnpm --dir ui exec vitest run apps/console/src/pages/auth/__tests__/LoginPage.dev-admin-hint.test.tsx at e8c3c5f4: Test Files 1 passed (1), Tests 12 passed (12), lock VERDICT command-exit 0. At merged head f302e1af, apps/console/src/pages/auth/: Test Files 28 passed (28), Tests 230 passed (230), VERDICT command-exit 0. Ablation via scripts/ablation-replace.mjs with the fix committed: anchor 'devSeedAdmin && authConfig?.emailPassword?.enabled !== false ? (' x1 -> x0, replacement 'devSeedAdmin ? (' x0 -> x1, blob 3d2fbca8b466 -> fa92222ba639; result: 'renders no row when the server turned email and password sign-in off' failed, Tests 1 failed / 11 passed (VERDICT command-exit 1); restored blob == HEAD 3d2fbca8b466, git diff HEAD empty, git status clean. No build/dist leg: the console test imports LoginPage from source. pnpm --filter @object-ui/console run type-check exit 0; eslint on both touched files exit 0.",
  "gates": "Local: dispatch-gates --commands --repo objectstack-ai/objectstack derived 34 commands; each run with exit captured before any pipe, all 34 exit 0 (33 at e8c3c5f4; check:registry-log-declared was killed by my first runner's 580 s timeout and re-run to exit 0 in the second batch; pnpm --dir ui exec vitest run scripts/ exit 0, 170 files passed / 2 skipped). --ran reconciliation at f302e1af: 34 derived, 34 run, 0 NOT-MEASURED, 0 UNRUN, all with recorded exit codes (a DERIVED zero). Outside the derivation, also exit 0: pnpm --dir ui run check:spec-symbols, pnpm check:changeset-fixed; node scripts/check-sdui-manifest.mjs is in the derived set, exit 0. origin/main merged once (f302e1af, 3 incoming commits, none touching ui/apps/console/src/pages/auth/ or ui/packages/auth/). CI at f302e1af when the report was written: 20 check-runs, 17 in_progress, 3 skipped, 0 failed; convergence goes to the seat.",
  "line_budget": "3 files, +40 / -2 (42 changed lines, under the 3000 human-merge threshold): LoginPage.tsx +6/-1, test +24/-1, changeset +10.",
  "files_changed": [
    ".changeset/30420-dev-admin-chip-password-off.md",
    "ui/apps/console/src/pages/auth/LoginPage.tsx",
    "ui/apps/console/src/pages/auth/__tests__/LoginPage.dev-admin-hint.test.tsx"
  ],
  "deviations": [
    "Commit trailer: the dispatch's Co-Authored-By line names a model; the pre-push check:commit-card-trailers refused it (the trailer pair is model-free per AGENTS.md and os-dev.md). The unpublished commit was amended to the model-free pair (Co-authored-by: Claude, noreply address, plus the Claude-Session line) and then pushed; no override used. Every later artifact (PR body, changeset, this report) carries no model identifier.",
    "The new false-case test lives in the existing file as a new it() inside the existing describe; nothing outside the declared file surface was touched."
  ],
  "dogfood_battery": "n/a — no ! in the PR title and Clause-②: no without a (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay pr_create (workflow dispatch, run 42043657108, PR #30531, body read back 3839/3839 bytes identical, assignees none, labels none); post-stamped os-dev-report comment on #30420. git push is not counted as a REST write.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": []
}

domain:ui#4 · os-sales · session_01L6bhgVfPeFZkN1FP93imKU

Landing record · 2026-11-05T15:42Z

PR #30531 merged 2026-11-05T15:39Z as 35a8f088aa (seat ACCEPT 6660501747 on head f302e1af), Fixes #30420.

probe	reading
`git grep -n "devSeedAdmin && authConfig?.emailPassword?.enabled !== false" origin/main -- ui/apps/console/src/pages/auth/LoginPage.tsx`	1 hit, line 402 (the dev-admin row is drawn only while email + password sign-in is not switched off)
card state	closed (completed) by the merge

State change: pm:dispatched removed; nothing remains on this card.

Generated by Claude Code

Navigation Menu

Repository navigation

Console sign-in page offers "Sign in as dev admin" when email and password sign-in is off, and the server refuses it #30420

Observed

Wanted

Serial

Triage: audit · p3 · `domain:ui` · `pm:blocked` · 2026-11-05T11:02Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Console sign-in page offers "Sign in as dev admin" when email and password sign-in is off, and the server refuses it #30420

Description

Observed

Wanted

Serial

Activity

objectstack-fleet commented on Nov 5, 2026

Triage: audit · p3 · domain:ui · pm:blocked · 2026-11-05T11:02Z

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p3 · `domain:ui` · `pm:blocked` · 2026-11-05T11:02Z