Repository navigation
plugin-auth: derive the SCIM connection-id cap from SCIM_SERVICE_PRINCIPAL_PREFIX #31033
Description
domain:server#3 · os-elon-musk · session_016WV4cytQjG9X1CrCgytUM5
Follow-up of #30958 / #30960 (PRs #30991 and #30989, both merged).
packages/plugins/plugin-auth/src/scim-connection-admin.ts computes MAX_SCIM_CONNECTION_ID = MAX_TEXT - 'svc:scim:'.length (246) with the prefix spelled literally. #30989 exports the same prefix as SCIM_SERVICE_PRINCIPAL_PREFIX from scim-connection-service.ts. If the prefix ever changes, the cap drifts away from the actor label it protects, and sys_audit_log.actor (255) could overflow.
Fix: import SCIM_SERVICE_PRINCIPAL_PREFIX and use its .length. The existing unit pin (246 accepted, 247 refused, 9 + 246 === 255) keeps holding. This is a one-line change, patch on @objectstack/plugin-auth.
Optional in the same stroke: the #30991 changeset names the two routes but not the two new public AuthManager methods (isScimWired, mintScimConnectionCredential). Adding one "Exported" line would complete the record.
Activity
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p3 ·
domain:server· 2026-11-06T18:55Z⛔ Not a claim.
MAX_SCIM_CONNECTION_IDspells thesvc:scim:prefix literally, beside the exportedSCIM_SERVICE_PRINCIPAL_PREFIX. If the prefix changes, the cap drifts from the actor label it protects. The existing pin keeps holding.domain:serverkept.pm:queue. The optional changeset line rides along if the seat takes it.Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#3 · marchtian · session_017ihL2dFb2QdZEHEJ83cR2B
Claim: PM loop round 1 · 2026-11-07T14:12Z
Session:
session_017ihL2dFb2QdZEHEJ83cR2BAccount:
marchtianBranch:
claude/project-thread-2aak0oWorktree:
objectstack-issue-31033(the card thread's own checkout)Domain:
domain:serverSeat:
domain:server#3File surface:
packages/plugins/plugin-auth/src/scim-connection-admin.ts(+ its test if needed) and.changeset/**(stop on breach; explain in the report)Container & model:
S mechanical,mode:thread(S would stay in-seat, but the seat session can push only its mailbox branch) (card thread cmsg_01VmuUhXU9SSUzqJYyXSmYSiUsur2LX4rmbgekcVwW8NoW of this account's project),model: TIER_DEFAULT — dispatch-gates --tier: no path-derived mandate,effort: session default — card-thread effort is set by the maintainer only; the seat's reading is medium (S)Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6692877129
Premise: holds — MAX_SCIM_CONNECTION_ID spells the svc:scim: prefix literally beside the exported SCIM_SERVICE_PRINCIPAL_PREFIX
Serial constraints cleared: PR #31119 (#31032), which touched the same file, MERGED; open PR #31132 (#31076, this seat) touches mcp-token-revocation.ts only; open PR #31013 touches other plugin-auth files
The dispatch order is the card thread's opening message (files
server-seat-3/orders/_standing.md+server-seat-3/orders/31033.mdin this account's project); slot granted by the project coordinator.objectstack-fleet commentedon Nov 7, 2026
domain:server#3 · marchtian · session_017ihL2bjuYso9Pes3WcUTEb
os-dev-report
{ "issue": 31033, "status": "done", "branch": "claude/project-thread-2aak0o", "pr": "https://github.com/objectstack-ai/objectstack/pull/31150", "head": "cb24c94f85fd2e4c068a11b0a328ba01ffd88c6b", "session": "session_017ihL2bjuYso9Pes3WcUTEb", "premise_still_valid": true, "summary": "MAX_SCIM_CONNECTION_ID in scim-connection-admin.ts now reads SCIM_SERVICE_PRINCIPAL_PREFIX.length (imported from scim-connection-service.ts) instead of a second literal 'svc:scim:'; value unchanged (246). Own patch changeset added. Optional item taken: the #30958/#30991 changeset is still pending on main, so the Exported paragraph naming AuthManager.isScimWired() and mintScimConnectionCredential(engine, input) was inserted THERE (no sentence rewritten), declared on the PR as a DELIBERATE CORRECTION; Check Changeset red is the expected consequence.", "tests": "plugin-auth test at cb24c94f: 234/234 files, 4168 passed / 10 skipped, lock VERDICT command-exit 0 (also green at 1f6f18d2: 4164 passed). Existing pin unchanged. Reverse proof (one-shot, not kept): scripts/ablation-replace.mjs mutated SCIM_SERVICE_PRINCIPAL_PREFIX to the 10-char 'svc:scimx:' (anchor 1 to 0, blob 9557afe1 to 33e63b7e); scim-connection-admin.test.ts 'leaves room' went red: 246-char mint answered 400 'at most 245 characters' (expected 400 to be 200). Restored by the tool; git hash-object equals HEAD blob 9557afe1, git status clean; file rerun 10/10 green. Source-relative imports, no dist leg.", "gates": "Local: plugin-auth typecheck VERDICT command-exit 0 at cb24c94f; eslint --no-inline-config on the touched source :: exit 0 (plugin-auth has no lint script; repo-wide pnpm lint is CI's). dispatch-gates --commands derived 55 families, identical before and after merging origin/main; all 55 run at 1f6f18d2: 54 :: exit 0, 1 :: exit 1 = node scripts/check-empty-changeset.mjs --base origin/main (DELIBERATE CORRECTION class, expected; Check Changeset is not a required context). Two first exited 3 (check-plugin-teardown-shape --self-test: fixture fetched; check:dual-build-cjs-loads: full packages build 81/81) and were rerun exit 0. --ran reconciliation: 55 derived, 55 run, 0 NOT-MEASURED, 0 UNRUN. CI check-runs on cb24c94f: in_progress at report time.", "dogfood_battery": "n/a: no ! in the PR title and Clause-② no without a (narrowing) arm", "line_budget": "19 changed lines (+17/-2), 3 files, under the 3000 human-merge threshold", "files_changed": [ ".changeset/30958-scim-connection-credential-door.md", ".changeset/31033-scim-connection-id-cap-from-prefix.md", "packages/plugins/plugin-auth/src/scim-connection-admin.ts" ], "deviations": [ "Gate union ran at 1f6f18d2, not the final head cb24c94f: the head is a merge of origin/main whose 2 incoming commits touch only plugin-auth mcp-token-revocation files; derivation identical; plugin-auth test and typecheck rerun green on cb24c94f.", "Edits a pending changeset this PR did not add (order item 2): DELIBERATE CORRECTION declared on the PR with the inserted paragraph quoted; seat confirmation by its own record per landing-operations.md." ], "mcp_calls": "0", "api_writes": "2 relay requests: pr_create (POST pulls #31150 + POST issues/31150/assignees marchtian) via fleet-write run 42383286346; this os-dev-report comment (POST issues/31033/comments) via post-stamped. git push not counted.", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [] }objectstack-fleet commentedon Nov 7, 2026
domain:server#3 · marchtian · session_017ihL2dFb2QdZEHEJ83cR2B
Landed · 2026-11-07T15:59Z
6a01718a7a, head56589092edFixes #31033State:
pm:dispatchedremoved.