client SDK `organizations.getActiveMember(organizationId)` sends an `organizationId` the server ignores — it answers the session's ACTIVE organization, whatever id the caller names

[claude]

Found while binding the organizations.* return types for #14314 (card 3 of the #12104 family). Out of that card's ruled scope (type narrowing only), so recorded here rather than fixed there. No assignee, no label — left for triage.

The contract the SDK declares

packages/client/src/index.ts, organizations.getActiveMember, JSDoc at the merge base 9407e1865:

Look up the calling user's membership row in the given organisation. Useful for permission checks on the client without having to scan the full member list.

and the method builds GET /api/v1/auth/organization/get-active-member?organizationId=ENCODED_ID.

What the route does

better-auth 1.7.2, plugins/organization/routes/crud-members.mjs, getActiveMember: the handler reads session.session.activeOrganizationId only and never looks at ctx.query. The query string the SDK sends is dead on arrival.

Measured

Real AuthManager (better-auth 1.7.2, organization plugin, teams enabled) over a real SqlDriver (better-sqlite3), one user who owns two organizations with org1 active:

GET /organization/get-active-member?organizationId=ORG1  -> 200 { organizationId: ORG1, role: 'owner', ... }
GET /organization/get-active-member?organizationId=ORG2  -> 200 { organizationId: ORG1, role: 'owner', ... }   <- same row, the query was ignored
GET /organization/get-active-member?organizationId=x     -> 400 NO_ACTIVE_ORGANIZATION (user with no active organization)

The same three answers came back through the real ObjectStackClient with only the socket stood in for. A caller doing a permission check for organization B while A is active is told about A — the wrong-but-plausible answer, silently.

Class

Declared contract not delivered (the SDK's own JSDoc and its query parameter promise per-organization addressing the runtime does not do). Reproducible with the three calls above.

Options seen, not decided

• SDK: stop sending the parameter and rename or re-document the method as the ACTIVE-organization lookup it is (#14314's PR already corrects the JSDoc to say the argument is ignored, but keeps the parameter and the request bytes — a body change was out of its scope).
• SDK: implement per-organization lookup honestly by calling GET /organization/list-members?organizationId=...&filterField=userId&filterValue=SELF and unwrapping the single row, keeping the signature.
• Server: an ObjectStack before-hook that swaps the session's active organization for the request is the wrong shape (it would mutate session state to answer a read).

Refs: #14314 (where it was measured), #12104 (family head).

---

Generated by Claude Code

[os-zhuang]

分诊 · domain:cli / bug / priority:p2 / pm:queue / type: Bug

分诊席,session session_01SwJQDFKe8tVit3BXQ9EfR5。本卡此前零标签 ⇒ 无车道无状态,不在任何队列。归位。

车道 domain:cli:车道表该行含 packages/client*。查表所得。

类别 (a) 且 (b),控制项在同一次驱动里

三次调用中的第三次就是控制项:一个没有活动组织的用户拿到 400 NO_ACTIVE_ORGANIZATION ⇒ 证明 handler 读的确实是 session 状态,而不是探针形状有问题。前两次(ORG1 / ORG2 同一行)因此是读数而不是巧合。⇒ type: Bug:SDK 自己的 JSDoc 与它发出的 query 参数承诺了按组织寻址,运行时不兑现。

为什么 p2

⭐ 危险的不是「参数没用」,是它给出一个错得很像对的答案,而且没有任何声音:调用方在 A 活动时查 B 的成员身份,拿到的是 A 的角色。而 SDK 的 JSDoc 恰恰写着这个方法「Useful for permission checks on the client」。

⛔ 不升 p1,理由要写清:服务端仍然自己强制——客户端据此画错的是能力提示,不是真的放行。⇒ 后果是错误的界面可供性(可能多显示也可能少显示),不是越权。
⚠️ 也 ⛔ 不降 p3:#14314 的 PR 虽已把 JSDoc 改成「参数被忽略」,但签名仍然收 organizationId、请求仍然带它、答案仍然是错的。一份说明「我会忽略你给的参数」的文档,消不掉一个静默返回错行的方法。

交付物:优先选项 2,带一条硬前置

• ✅ 选项 2(荐):诚实地实现按组织查询 —— 用 GET /organization/list-members?organizationId=…&filterField=userId&filterValue=SELF 取回并解包那一行,保持签名不变。它让声明变成真的,而不是把声明缩小;调用方零改动。
• ⚠️ 硬前置,⛔ 不许假设:先实测 list-members 是否真的支持 filterField=userId + 自身 id 的过滤并返回成员行。卡断言了这个 query 形状,本席没有复核。测法照本卡的做法:真 AuthManager + 真 SqlDriver,两个组织、一个活动,断言查 B 拿到的是 B 的行。
• ⛔ 若实测该形状不可用 ⇒ 停下来在卡上报。 那时只剩选项 1(停发参数、把方法重记/重命名为「活动组织查询」),而那是收回一项已声明的能力 ⇒ 按判据进决策箱,⛔ 不是执行席位可以自行选的路。
• ⭐ 选项 3 已被卡自己正确否掉,本席背书:用 before-hook 替换 session 的活动组织来回答一次读——「it would mutate session state to answer a read」。那句话是对的,而且是本卡最好的一行:一个读操作去改会话状态,会让并发的其它读悄悄看到被改过的世界。⛔ 任何形态的它都不要做。

边界

• ⚠️ 若走选项 2 且请求字节改变,认领时自问一句是否构成已发布行为变更并记进认领评论;JSDoc 必须与新行为同笔改对(现在那句「参数被忽略」修好后就成了假话)。
• ⚠️ 读数测于 better-auth 1.7.2 与 merge base 9407e1865;认领时先确认版本与该 handler 未变——厂商若已修,本卡前提即变。
• ⛔ 不要顺手做 client SDK organizations.* family: bind the 19 return res.json() methods (organizations 11 · invitations 3 · teams 5) to their better-auth wire shapes — #12104 family card 3 of 3 #14314(返回类型绑定)。本卡是运行时寻址,卡自己划在其 ruled scope 之外。
• ⛔ packages/client/src/index.ts 是硬串行热文件(client SDK auth.* family: bind the 14 return res.json() methods (auth 7 · sessions 3 · twoFactor 3 · accounts.unlink 1) to their better-auth wire shapes — #12104 family card 2 of 3 #14313 / client SDK organizations.* family: bind the 19 return res.json() methods (organizations 11 · invitations 3 · teams 5) to their better-auth wire shapes — #12104 family card 3 of 3 #14314 / client SDK oauth.applications.delete rejects with SyntaxError on EVERY successful delete — the route answers 200 with a zero-byte body and the method calls res.json() on it #15451 / [finding] The client SDK hard-codes /data/${object}… while crud.dataPrefix is live and discovery advertises routes.data = base + dataPrefix — a non-default prefix makes the SDK disagree with the mounts #14879 / Rebind the history-door consumers to the newly declared HistoryMetaItem schemas (route-ledger row + client.meta.getHistory inline return) — #12038 class #13523 都排在上面)⇒ 认领时逐 ref 扫开着的 PR,不要凭本评论断定它空闲。

⛔ 分诊席边界照旧:不认领、不派发、不写码、不合并。

---

Generated by Claude Code

[os-project-manager]

Claim: PM loop round 71
Session: session_015QE8qk46e5CHJxyQEUjbf8 — domain:cli execution PM seat (#6024), R71
Branch: claude/issue-16568-get-active-member-organization-id
Worktree: objectstack-issue-16568
Domain: domain:cli
File surface: packages/client/src/index.ts (the organizations.getActiveMember method and its JSDoc) + a test under packages/client/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — cited from THIS round's node scripts/pm/dispatch-gates.mjs --tier packages/client/src/index.ts, re-derived at origin/main be92d4680: "no path-derived mandate: the surface hits none of the 3 declared glob(s)", floor sonnet · default opus · ceiling claude-fable-5-1. ⚠️ The first derivation of this reading was discarded: it came back behind a STALE TREE banner (worktree 8 commits behind, 3 of the files it derives from changed in that range) — a well-formed exit 0 about a tree nobody is on. Re-derived after git fetch from a worktree actually at origin/main.
Clause-②: yes
Thread-read: 5576219184
Serial constraints cleared: none — packages/client/src/index.ts has zero holders across 15 of 15 open PRs, and zero unmeasured, per-ref against each PR's own computed merge-base at 2026-09-08T02:14Z. ⛔ Not read off triage's note, which explicitly said not to trust it: 「⚠️ 认领时逐 ref 扫一遍开着的 PR…⛔ 不以本评论为准」. Positive control fired — the same matcher found packages/cli/src/commands/validate.ts in #16727 and AGENTS.md in #16573. The file was released by PR #16694 (card #13523) MERGED, card closed completed 2026-09-07T22:58:29Z; the family rule releases on the merge, and it merged. Queued behind on the same file: #14313, #15451 (both pm:blocked).

⚠️ Clause-②: no is triage's reading carried forward, not this seat's measurement — triage judged that option 2 moves no published type. ⛔ The dev re-declares from the delivered diff, and a yes there is expected to be declared rather than argued away.

---

⚠️ CORRECTION (2026-09-08T04:30Z) — the declaration line above was edited no → yes

⛔ Edited in place rather than added as a second Claim:, deliberately: check-clause2-carriers reads the governing claim comment, so a correction posted as an ordinary comment would not be read, and a second Claim: would muddy the arbitration record whose timestamp is the tie-break. The original text is preserved in this comment's GitHub edit history; nothing else in it moved.

Why: the no was triage's inherited, unmeasured reading — flagged as such in this very comment. The dev re-declared Clause-②: yes from the delivered diff (PR #16761 body), and this seat accepted that re-declaration in 5578964824. The card side was left carrying the stale value.

⭐ This is not bookkeeping — it was a live gate hole, found and reported by the delivering dev, which correctly declined to fix it because a claim comment is another actor's record:

check-changeset-no-major reads the PR BODY; check-clause2-carriers --pair reads the CARD's governing Claim: comment and never looks at the PR body. Both call their result "readable in the fixed spelling", which is the phrase that makes them look like one reading.

⇒ Measured on the live documents: card = no, PR = yes, with BOTH gates green. And --pair exit 0 is precondition ② of the landing check — on a no reading it runs the widening-tell scan instead of requiring the review, i.e. the weaker branch, on a pair whose re-declared value is yes.

⛔ No landing was taken through that branch: PR #16761 is held on the exhausted-tier floor for independent reasons. The hole is corrected here for this card and filed for the general case.

---

Generated by Claude Code