feat(plugin-auth): a membership that ends takes the session's claim on that organization with it — re-pointed if the user belongs elsewhere, revoked if not

.changeset/membership-ended-session-revoke.md

@@ -0,0 +1,41 @@
+---
+'@objectstack/platform-objects': minor
+'@objectstack/plugin-auth': minor
+---
+
+`sys_session.revoke_reason` accepts `organization_membership_ended` — "Remove member" now actually signs the person out
+
+Removing a member deleted the `sys_member` row and left the session alive, for up to seven
+days. #15409 closed the security half per request (a session whose `activeOrganizationId`
+is not backed by a membership resolves with no active organization). This is the courtesy
+half an admin was promised, and it is **never the enforcement**: a trigger can be missed,
+an evaluation cannot.
+
+- **New `revoke_reason` value, `organization_membership_ended`** — an accept-set widening
+  on a published system object, hence `minor` on `@objectstack/platform-objects`. Every
+  reason before it is a timer (`idle_timeout`, `absolute_max`, `concurrent_cap`) or an
+  interactive revoke (`user_revoked`, `admin`); this is the first authorization-event
+  cause. There is no Zod enum behind the column — it is free `text` — so the field's own
+  description is the published vocabulary, and that is where the value is declared. The
+  string deliberately matches the one the API-key arm of the same ruling family already
+  mints for this event (`authRefusal.reason` in `resolve-authz-context.ts`), so one grep
+  finds every place the platform acts on a membership ending.
+- **The trigger acts on the ORGANIZATION'S CLAIM, never on the user** (maintainer ruling,
+  decision batch #49 item 4, option B). A user who still holds another membership is
+  **re-pointed** to it — never signed out of organizations they legitimately belong to. A
+  user with no remaining membership has their session revoked through the existing
+  `revoked_at` / `revoke_reason` mechanism, which expires it in place: better-auth returns
+  nothing on the next request and the Console's existing 401 → login redirect handles it,
+  with **no client change**.
+- **The seam is an engine hook on `sys_member`**, not a hook on better-auth's
+  `/organization/remove-member`. A census measured that the endpoint, a direct delete, a
+  bulk delete, the cascade from a `sys_user` delete and an organization re-point all reach
+  the hook, while an endpoint hook would have reached one of them. Same precedent as
+  `last-admin-guard.ts`.
+- **New public surface on `@objectstack/plugin-auth`** — `MEMBERSHIP_ENDED_REVOKE_REASON`,
+  `endSessionClaimsForEndedMembership` and `registerMembershipEndedSessionTrigger`, hence
+  `minor` rather than `patch`.
+
+Known open by measurement, not by omission: a raw driver delete bypasses the trigger
+entirely, and cloud's package-uninstall sample-data purge is one (filed as cloud#2003). The
+per-request check covers it; the courtesy does not.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3857` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1412` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1427` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |

content/docs/permissions/tenant-audit-census.mdx

@@ -98,7 +98,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **67 of the 219 sites are spelled that way**. A
+forwarding shim cannot, and **67 of the 221 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -147,10 +147,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **219** |
+| 175 write call sites | quoted in the merged changeset | **221** |
 | 24 carrying no tenant context | quoted in the merged changeset | **9** provable and tenancy-enabled; **32** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **147 of 219** decidable, **72** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 101 decidably elevated, 0 decidably not, 101 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **147 of 221** decidable, **74** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 103 decidably elevated, 0 decidably not, 101 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -167,11 +167,11 @@ would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-101 of 219 (46%) as decidably elevated, with 101 more whose elevation is a
+103 of 221 (47%) as decidably elevated, with 101 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `9 / 219`, and say what it is**: the sites whose options argument was
+⇒ **Cite `9 / 221`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **32 further sites** have an options argument this
@@ -183,31 +183,31 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **219** |
+| write call sites on the application surface | **221** |
 | …whose object name is statically decidable | 147 |
-| …whose object name is chosen at run time | 72 |
+| …whose object name is chosen at run time | 74 |
 | …against an object with tenancy ENABLED | 147 |
 | …against an object that declares tenancy off | 0 |
-| threading a tenant context | 135 |
+| threading a tenant context | 137 |
 | PROVABLY carrying none (options read, no context key) | **17** |
 | …of those, against a decidably tenancy-enabled object | **9** |
 | options argument UNREADABLE — may or may not carry one | 67 |
 | …of those, against a decidably tenancy-enabled object | 32 |
-| threading a decidably ELEVATED (`isSystem`) context | 101 |
+| threading a decidably ELEVATED (`isSystem`) context | 103 |
 | threading a context that is decidably NOT elevated | 0 |
 | threading a context whose elevation is a run-time fact | 101 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 174 |
+| receiver carried a readable engine type | 176 |
 | receiver erased, placed by the object NAME | 19 |
 | receiver erased, placed by an `object: string` PARAMETER | 15 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 11 |
 
 | object name spelled inline | 108 |
 | object name spelled through a `const` | 39 |
 | object name is an `object: string` parameter | 19 |
-| object name is some other run-time expression | 53 |
+| object name is some other run-time expression | 55 |
 
 The corpus walked is every tracked non-test source under `packages/services/`
 and `packages/plugins/`; calls to a same-named method on something that is not
@@ -224,13 +224,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-03 at `631038b03`.
+Measured on 2026-09-05 at `8a7446de8`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 542 |
-| engine-shaped types recognised | 57 |
+| tracked non-test sources scanned | 547 |
+| engine-shaped types recognised | 58 |
 | declared objects in the registry | 298 |
-| same-named calls subtracted as non-engine | 130 |
+| same-named calls subtracted as non-engine | 134 |
 
 {/* END GENERATED: tenant-audit-census */}

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -29,17 +29,17 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 219 |
+| Write call sites | 221 |
 | Object name statically decidable | 147 |
-| Object name chosen at run time | 72 |
+| Object name chosen at run time | 74 |
 | Against a tenancy-enabled object | 147 |
 | Against an object declaring tenancy off | 0 |
-| Threading a tenant context | 135 |
+| Threading a tenant context | 137 |
 | Provably carrying none | 17 |
 | …and decidably tenancy-enabled | 9 |
 | Options argument unreadable | 67 |
 | …and decidably tenancy-enabled | 32 |
-| Threading a decidably elevated context | 101 |
+| Threading a decidably elevated context | 103 |
 | Threading a decidably non-elevated context | 0 |
 | Threading a context of undecidable elevation | 101 |
 
@@ -52,14 +52,14 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-03 at `631038b03`.
+Measured on 2026-09-05 at `8a7446de8`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 542 |
-| engine-shaped types recognised | 57 |
+| tracked non-test sources scanned | 547 |
+| engine-shaped types recognised | 58 |
 | declared objects in the registry | 298 |
-| same-named calls subtracted as non-engine | 130 |
+| same-named calls subtracted as non-engine | 134 |
 
 ## Every site
 
@@ -92,6 +92,7 @@ Measured on 2026-09-03 at `631038b03`.
 | `packages/plugins/plugin-auth/src/backfill-account-issuer.ts` | `update` | `sys_account` | enabled | elevated | 1 |
 | `packages/plugins/plugin-auth/src/ensure-default-organization.ts` | `insert` | `object` | undecidable | elevated | 1 |
 | `packages/plugins/plugin-auth/src/member-role-canonical.ts` | `update` | `MEMBER_OBJECT` | undecidable | elevated | 1 |
+| `packages/plugins/plugin-auth/src/membership-ended-session.ts` | `update` | `SystemObjectName.SESSION` | undecidable | elevated | 2 |
 | `packages/plugins/plugin-auth/src/objectql-adapter.ts` | `delete` | `m` | undecidable | options unreadable | 1 |
 | `packages/plugins/plugin-auth/src/objectql-adapter.ts` | `insert` | `m` | undecidable | options unreadable | 1 |
 | `packages/plugins/plugin-auth/src/objectql-adapter.ts` | `update` | `m` | undecidable | options unreadable | 1 |

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -328,11 +328,11 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_at: {
         label: "Revoked At",
-        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin / organization membership ended). System-managed."
       },
       revoke_reason: {
         label: "Revoke Reason",
-        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, …)."
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, …)."
       },
       active_organization_id: {
         label: "Active Organization"

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -328,11 +328,11 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_at: {
         label: "Revoked At",
-        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin / organization membership ended). System-managed."
       },
       revoke_reason: {
         label: "Revoke Reason",
-        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, …)."
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, …)."
       },
       active_organization_id: {
         label: "Organización activa"

packages/platform-objects/src/apps/translations/es-ES.source-hashes.generated.ts

@@ -567,9 +567,9 @@ export const esESGeneratedSourceHashes: Readonly<Record<string, string>> = {
   "objects.sys_secret.fields.id.label": "00b0385c9c152888",
   "objects.sys_session.fields.last_activity_at.help": "f7851e9373505e73",
   "objects.sys_session.fields.last_activity_at.label": "43bd2f1b231bc12b",
-  "objects.sys_session.fields.revoke_reason.help": "ff2c9a1aa9be356d",
+  "objects.sys_session.fields.revoke_reason.help": "fcd18baf6b341b7f",
   "objects.sys_session.fields.revoke_reason.label": "13b0146153a2ecf8",
-  "objects.sys_session.fields.revoked_at.help": "62d1b62cde5ce487",
+  "objects.sys_session.fields.revoked_at.help": "77a508fdceda2f6d",
   "objects.sys_session.fields.revoked_at.label": "054f918e632528c7",
   "objects.sys_setting.fields.scope.options.global": "5e377106508d2ecd",
   "objects.sys_setting_audit._views.recent.label": "62d27bb9d0349c99",

packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts

@@ -328,11 +328,11 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_at: {
         label: "Revoked At",
-        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin / organization membership ended). System-managed."
       },
       revoke_reason: {
         label: "Revoke Reason",
-        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, …)."
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, …)."
       },
       active_organization_id: {
         label: "アクティブ組織"

packages/platform-objects/src/apps/translations/ja-JP.source-hashes.generated.ts

@@ -560,9 +560,9 @@ export const jaJPGeneratedSourceHashes: Readonly<Record<string, string>> = {
   "objects.sys_secret.fields.id.label": "00b0385c9c152888",
   "objects.sys_session.fields.last_activity_at.help": "f7851e9373505e73",
   "objects.sys_session.fields.last_activity_at.label": "43bd2f1b231bc12b",
-  "objects.sys_session.fields.revoke_reason.help": "ff2c9a1aa9be356d",
+  "objects.sys_session.fields.revoke_reason.help": "fcd18baf6b341b7f",
   "objects.sys_session.fields.revoke_reason.label": "13b0146153a2ecf8",
-  "objects.sys_session.fields.revoked_at.help": "62d1b62cde5ce487",
+  "objects.sys_session.fields.revoked_at.help": "77a508fdceda2f6d",
   "objects.sys_session.fields.revoked_at.label": "054f918e632528c7",
   "objects.sys_setting_audit._views.recent.label": "62d27bb9d0349c99",
   "objects.sys_setting_audit.fields.id.label": "00b0385c9c152888",

packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts

@@ -328,11 +328,11 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_at: {
         label: "Revoked At",
-        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+        help: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin / organization membership ended). System-managed."
       },
       revoke_reason: {
         label: "Revoke Reason",
-        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, …)."
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, …)."
       },
       active_organization_id: {
         label: "当前组织"

packages/platform-objects/src/apps/translations/zh-CN.source-hashes.generated.ts

@@ -507,9 +507,9 @@ export const zhCNGeneratedSourceHashes: Readonly<Record<string, string>> = {
   "objects.sys_secret.fields.id.label": "00b0385c9c152888",
   "objects.sys_session.fields.last_activity_at.help": "f7851e9373505e73",
   "objects.sys_session.fields.last_activity_at.label": "43bd2f1b231bc12b",
-  "objects.sys_session.fields.revoke_reason.help": "ff2c9a1aa9be356d",
+  "objects.sys_session.fields.revoke_reason.help": "fcd18baf6b341b7f",
   "objects.sys_session.fields.revoke_reason.label": "13b0146153a2ecf8",
-  "objects.sys_session.fields.revoked_at.help": "62d1b62cde5ce487",
+  "objects.sys_session.fields.revoked_at.help": "77a508fdceda2f6d",
   "objects.sys_session.fields.revoked_at.label": "054f918e632528c7",
   "objects.sys_setting_audit._views.recent.label": "62d27bb9d0349c99",
   "objects.sys_setting_audit.fields.id.label": "00b0385c9c152888",

packages/platform-objects/src/identity/sys-session.object.ts

@@ -174,15 +174,27 @@ export const SysSession = ObjectSchema.create({
       required: false,
       readonly: true,
       group: 'Session',
-      description: 'When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed.',
+      description: 'When set, this session was revoked (idle / absolute-max / concurrent-cap / admin / organization membership ended). System-managed.',
     }),
     revoke_reason: Field.text({
       label: 'Revoke Reason',
       required: false,
       maxLength: 64,
       readonly: true,
       group: 'Session',
-      description: 'Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, …).',
+      // [#15784] The accept set widens here, and this description IS the
+      // published vocabulary — there is no Zod enum behind this column (it is
+      // free `text`), so this line is the only contract a consumer can read.
+      // Every value before `organization_membership_ended` is either a TIMER
+      // (idle_timeout, absolute_max, concurrent_cap) or an interactive revoke
+      // (user_revoked, admin — `plugin-auth/session-tombstone.ts`); that one is
+      // the first AUTHORIZATION-EVENT cause, written when the membership
+      // backing a session's active organization ends and the user holds no
+      // other. ⛔ It is a COURTESY, never the enforcement: the wall is the
+      // per-request membership check in `resolve-authz-context.ts`.
+      description:
+        'Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, '
+        + 'admin, organization_membership_ended, …).',
     }),
 
     // ── Active context (multi-org/team) ──────────────────────────