Repository navigation
[需要上游访问权限] 把 #8243 的 better-auth 缺陷机制提交到 better-auth/better-auth —— 文本已拟好,但 agent 会话无法访问该仓库 #8446
Description
Activity
Triage: routed
domain:identity(lineage: #8243's identity-lane ruling), type Task, gradedneeds-user-decision— deliberately, because this card needs no engineering and no dev can execute it: every agent session shares the same three-repo access scope (verified in the card body:issue_writedenied,add_repocross-tier denied, direct API 403), so the only actor who can complete it is a human with upstream access. The decision-box label is used here as the maintainer's inbox for a required human ACTION, not a design fork.Four-prism block (compact — this is an action request, not a design decision):
- Platform long-term coherence — neutral; no code changes hinge on it.
- Measured business pull — direct: the 2026-08-13 maintainer ruling on better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 names the upstream filing as part of the deliverable and requires the link recorded on that card.
- AI-agent error-resistance — n/a (no code).
- Startup scope discipline — zero engineering; one human action, then close.
Recommendation: file the pre-drafted text (linked in the card, dedup already done against
better-auth#10734/#9401) verbatim tobetter-auth/better-auth, record the returned link on #8243, close this card. Nothing is blocked on it — PR #8432 proceeds independently, as the card argues.
Generated by Claude Code
Maintainer response recorded — the maintainer will file the upstream issue personally. Provenance: maintainer live session, 2026-08-13 ~23:50Z, verbatim 「接受你的全部建议」, accepting this seat's briefing of the full decision box; this card's briefed item was: no agent path exists (three access routes measured denied), the pre-drafted text is ready verbatim, and the filing needs the maintainer's own hands (~5 minutes).
Checklist for the filing (from the card, unchanged):
- Submit the pre-drafted body verbatim to
better-auth/better-auth: better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 (comment) - Record the returned upstream link on better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 (per that ruling's own requirement).
- Close this card.
The card stays in the decision box until the link lands — it is the only channel that keeps this visible; no further escalation will be added (no-nag rule).
Recorded by the triage seat on the maintainer's direct channel.
Generated by Claude Code
- Submit the pre-drafted body verbatim to
Done — filed upstream: better-auth/better-auth#10819
The maintainer filed it personally (2026-08-15), as this card and the triage seat both concluded was the only available path. All three checklist items are complete:
- ✅ Pre-drafted body submitted verbatim to
better-auth/better-auth— title and body byte-identical to the draft in better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 (comment), nothing re-authored. - ✅ Link recorded on better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 (per that ruling's own requirement) — better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 (comment). better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 is closed, so it is recorded here as well, as this card provided for.
- ✅ This card closed.
Access note, for whoever hits this next: the block was the agent-proxy repo scope, not GitHub permissions. A local
ghsession authenticated asos-zhuangreachesbetter-auth/better-authnormally. The three denials recorded in the card body were all the same scope limit measured through three different doors.Dedup was re-run against upstream immediately before filing and still holds — no existing report covers the bearer before-hook overwriting the session cookie.
- ✅ Pre-drafted body submitted verbatim to
由
domain:identity执行席位开出。未指派、未打标签交分诊 —— ⛔ 执行席位不定级。背景
#8243 的 maintainer 裁定把「提交上游 issue」列为交付物的一部分:
代码那两半已经实现并在 PR #8432 里(轮换 +
stop-impersonating的 bearer 恢复)。只有上游提交这一步做不了。为什么做不了 —— 是权限,不是遗漏
dev 试了三条路,全部被拒:
issue_write到better-auth/better-authAccess denied: repository not configured for this session. Allowed: objectstack-ai/objectstack, objectstack-ai/objectui, objectstack-ai/cloudadd_repo添加该仓库cross-tier adds are not supported in v1api.github.com/repos/better-auth/better-auth⛔ 我(PM 席位)受同一范围限制,复核后同样无法提交。这不是可以再派一个 dev 解决的事。
已完成的部分
拟好的完整正文在 #8243 的评论里:
#8243 (comment)
查重已做,不是「大概没有」:
better-auth#10734—— 另一个stopImpersonating的 cookie 缺陷,机制不同;better-auth#9401—— 已关闭,客户端useSession重新校验,不是这个;两者都不是本机制(bearer 的 before-hook 覆盖 session cookie)。
需要的动作
better-auth/better-auth;#8243 修的是一个安全端点上的静默 no-op:console(每次正常登录后都是 bearer 客户端)对一个安全相关的管理操作拿到 200,而操作实际没生效,后续写入被错误归因到管理员身上。为一个我们无权执行的上游动作压住这个修复,会让实际缺陷继续存在于一个谁也说不准何时能解锁的窗口里。
所以处置是:PR 照常武装落地,上游提交作为本卡单独跟踪。⛔ 但它不因此消失 —— 这正是本卡存在的理由。
顺带记录 dev 报的两条诚实边界(与本卡无关,供 review #8432 时参考)
auth.$context推导admin_sessioncookie 名,而 better-auth 在 baseURL 动态时按请求重新推导。前缀不匹配会让恢复头静默不匹配——但 vendor 路由随后会走它既有的大声 500,永远不会给出错误身份。失败方向是安全的,路径未测,已写进代码注释。相关:#8243、PR #8432、objectui#4467(客户端一半)。