refactor(sms): plugin-sms 更名为 service-sms（遵循 service-* 惯例）#2797
Merged
Conversation
…-sms Infrastructure services follow the service-* convention (service-messaging, service-settings, ...) - the plugin-* prefix was a misfit for a package whose whole job is registering the `sms` kernel service (plugin-email is legacy debt, not precedent). Same exports, same SmsServicePlugin class, same `sms` service id and settings namespace - only the package name and its home (packages/services/service-sms) change. The one published @objectstack/plugin-sms@14.3.0 release should be npm-deprecated in favour of @objectstack/service-sms. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013LXUXU66dBaP3SSG4ZVtuH
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 4 package(s): 101 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
…ugin plugins.phoneNumber existed in AuthPluginConfig (#2766) but `objectstack serve` never set it - there was no way to turn phone sign-in/OTP on from the CLI. Follows the OS_{DOMAIN}_{FEATURE}_ENABLED convention; default off. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013LXUXU66dBaP3SSG4ZVtuH
Found dogfooding the live flow: better-auth's /phone-number/send-otp stores the fresh code BEFORE invoking sendOTP, so a cooldown rejection thrown from the callback still rotated - and thereby invalidated - the previously delivered code. A user hitting resend during the cooldown (or an attacker spamming the endpoint) voided the valid OTP every time. The per-number cooldown/hourly-cap check now runs in the hooks.before middleware (assertPhoneOtpSendAllowed) for /phone-number/send-otp and /phone-number/request-password-reset - rejected requests never reach the endpoint handler, so the stored code survives. The sendOTP callback only delivers. Behaviour verified end-to-end against a live server. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013LXUXU66dBaP3SSG4ZVtuH
os-zhuang
marked this pull request as ready for review
July 10, 2026 15:42
This was referenced Jul 11, 2026
os-zhuang
added a commit
that referenced
this pull request
Jul 11, 2026
* docs(auth): document phone sign-in, admin user management, and bulk user import Catches content/docs/permissions/authentication.mdx up with the shipped auth surface (#2766 / PR #2771, SMS follow-up #2780 / PR #2797): - Phone-Number Sign-In section: plugins.phoneNumber flag (and the CLI OS_AUTH_PHONE_NUMBER_ENABLED override), /sign-in/phone-number, the OTP flows' dependency on a wired SMS service (rate-limited), and the placeholder-email semantics for phone-only accounts. - Admin User Management section: /admin/create-user (one-time temporary password + mustChangePassword → 403 PASSWORD_EXPIRED gate), /admin/set-user-password, /admin/import-users (invite/temporary policies incl. the SMS-invite path, upsert profile-field-only rules, 500-row sync cap, no undo). - API endpoint reference: new Phone Number and Admin User Management subsections. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016r6eiJzivw1CkwTDSGho1o * docs(auth): baseline better-auth 'role' boundary refs + regen reference docs check-role-word (ADR-0090 D3) flagged the two new mentions in authentication.mdx — both refer to better-auth's literal `role` scalar (a genuine boundary), so the file is baselined rather than reworded. Also picks up the generated reference docs that lag the merged spec: features.phoneNumber/phoneNumberOtp and the auth-config phoneNumber flag (#2766/#2780), plus component.mdx's relationshipValueField row. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016r6eiJzivw1CkwTDSGho1o --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
按维护者反馈（#2790 评审意见：不建议用
plugin-*）跟进 #2780/#2790。变更
@objectstack/plugin-sms→@objectstack/service-sms，目录迁至packages/services/service-sms。基础设施服务应遵循service-*惯例（对齐service-messaging/service-settings）；plugin-*不适合一个职责就是注册sms内核服务的包（plugin-email属历史债，不作先例）。SmsServicePlugin类名、sms服务 id、smssettings 命名空间、com.objectstack.service.sms插件 id 全部不变。git 以 rename 记录（源文件 100% 相似度）。serve.ts）、changesetfixed组、各处注释（spec 契约 / auth / messaging / settings manifest）、packages.mdx文档（Plugins 18 / Platform services 16，条目移至 services 段落）。说明
@objectstack/plugin-sms@14.3.0已随 chore: version packages #2792 发过一个版本，npm 上的旧包名建议由维护者执行npm deprecate @objectstack/plugin-sms "renamed to @objectstack/service-sms"（我没有 npm 权限）。check-changeset-fixed✓；service-sms构建 + 28 测试 ✓；CLI 构建 + 476 测试 ✓。🤖 Generated with Claude Code
https://claude.ai/code/session_013LXUXU66dBaP3SSG4ZVtuH
Generated by Claude Code