Repository navigation
IdP-managed tenancy: no write overwrites a newer change, and every sign-in is capped - #5
Merged
Merged
Conversation
…gn-in is capped Review findings on the apps that took #4: - The sign-in reconcile updates a membership only as it read it, so an owner promotion or an identity event in between wins. - A removal re-checks idp_synced_at in the DELETE, so a sign-in that stamped the row after the event's read keeps it. - Two different orgs that take the same free slug at once: the loser picks again instead of failing the sign-in. - Under managed tenancy every sign-in (magic link and dev login too) gets max_expires_at, from completeLogin. - OIDC_SESSION_MAX_AGE_DAYS is at most 30, the cookie's own life: the cookie is set once. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… row and a slug clash retry Second review pass: - A sign-in stamps tenants and memberships with the id_token's iat, and never writes over a row an identity event stamped later, so a token issued before an event cannot undo it or make it look stale. - A membership removed between the reconcile's read and its update is inserted again (the claims grant it). - The slug retry also catches createTenantForUser's own slug_taken check, and tries up to five times. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…one can restore it A known gap, recorded rather than closed: the id_token is issued at the callback's own code exchange, so the window is the second or two before a removal event (or a concurrent sign-in that cleared global admin), and the next sign-in or the session's end heals it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These fix the review findings on nearform/agentic-mapper#8 and nearform/unwind-next#9, the two apps that took #4.
upsertIdpMembershipupdates a membership only if its role and source are still what it read. An owner promotion or an identity event that lands in between wins, and the next sign-in reconciles from there.removeIdpMembershipsre-checksidp_synced_atin theDELETEitself. A sign-in that stamps the row after the event's read keeps the membership and its settings. Activity is recorded only for rows actually removed.oauth_failed.completeLogincaps every sign-in (OIDC, magic link and dev login), not only an OIDC one. ThemaxAgeMsoption is gone.OIDC_SESSION_MAX_AGE_DAYSis now at most 30. The cookie is set once, at sign-in, and lasts 30 days, so a longer cap would have been cut short by the browser.Tests: a dev login under managed tenancy gets
max_expires_at, and the config refuses 31. The two races aren't tested deterministically; the guards are in the SQL.The local gate passes except the kit-manifest test, which only fails because of untracked local files that CI doesn't see.
🤖 Generated with Claude Code