Repository navigation
feat(hub-zero)!: T6 signup policy to native authz (CL-8130) - #751
Merged
Merged
Conversation
…letion The closed-signup gate genesis.ts called through @workbench/access-policy was never wired into any hub composition; these cases tested behavior the next commit deletes. Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
…-8130) The closed-signup/sub-workbench policy table, checkSignupGate, and the tenant-scoped access-policy routes had no native equivalent and were never mounted by any hub composition (T1/T2 already repointed first-login onto native setup-status and left onboarding's provisioning routes unwired). Per CL-7575's ruling, native POST /api/tenants grant-gating is the only signup/child-tenant gate now; there is nothing to keep as a Workbench-side gate, so the package is deleted rather than carried forward unwired. - packages/onboarding: drops its dependency on @workbench/access-policy; genesis/provision no longer thread an accessPolicy gate through first-login (it was already always-undefined in production). - scripts/db-setup.ts, scripts/checks/no-product-tenancy.ts, scripts/checks/report-error-baseline.txt, tsconfig.build.json: drop the deleted package from migration wiring, the schema-table allowlist, the report-error baseline, and the build project graph. - packages/settings-ui: deletes the "Who can join" People-section panel and its API client — it called /api/tenants/:tenantId/access-policy, a route no hub composition ever mounted. Overlaps with the in-flight PR #745 (CL-8085), which independently deletes packages/onboarding's genesis/provisioner and adds an empty-hub count read to access-policy; whichever of the two lands second will need a small rebase against the other. Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
TENANCY.md's Signup mode and sub-workbench-creation sections, the package glossary, the migration-shape reference implementation pointer, and two package READMEs all named @workbench/access-policy as retained-but-unwired; it is now deleted outright. Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
TheGreatAxios
force-pushed
the
cl-8130-hub-zero-t6
branch
from
September 17, 2026 16:05
598932b to
f76c727
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hub-zero T6 (CL-8130, parent CL-7575). Deletes
@workbench/access-policy— the closed-by-default signup/sub-workbench-creation policy table,checkSignupGate, and its tenant-scoped routes — rather than keeping it around unwired.Per CL-7575's locked ruling ("later users sign up too; they do not mint tenants", "native
POST /api/tenantsgrant-gating is the only gate"), this package had no native equivalent worth keeping. It also turned out to already be fully disconnected onmain: hub-zero T1/T2 (#747, #748) had already repointed first-login onto native/api/setupstatus and leftpackages/onboarding'sPOST /provisionroute unmounted fromapps/hub, socheckSignupGatewas always called with no operator tenant and no caller ever passed anaccessPolicygate into it — dead code with a live-looking surface.What was deleted
packages/access-policy(whole package: policy table/schema,checkSignupGate,evaluateSignupGate,canCreateTenancy, the tenant-scoped/access-policyand/access-policy/child-tenantsroutes, migrations)packages/settings-ui's "Who can join" People-section panel and its API client (called a route no hub composition ever mounted)WORKBENCH_SIGNUP/WORKBENCH_ALLOWED_EMAIL_DOMAINS— confirmed these envs were already gone fromapps/hub/src/config.tsbefore this PR (an earlier cutover already removed them);rg "access-policy|HubSignupTenancy" apps/hubnow returns zero non-comment hitsWhat moved rather than deleted
apps/hub/src/index.ts's auth handler already carries no signup-gate wrap to remove (confirmed viarg); the native/api/setupcold-boot status route (CL-8112) is the only signup-adjacent surface left, and it was already nativepackages/onboarding's genesis/join first-login flow keepsPOST /api/tenantsas its only gate — it no longer threads an optionalaccessPolicygate through (that parameter was alwaysundefinedin production)Docs
Updated
docs/TENANCY.md's Signup and sub-workbench-creation sections,docs/GLOSSARY.md,docs/package-migrations.md's reference-implementation pointer, and two package READMEs to stop naming@workbench/access-policyas a retained-but-unwired package.Concurrency note
PR #745 (CL-8085, being rebased concurrently) independently deletes
packages/onboarding's genesis/provisioner and adds a small empty-hub count read topackages/access-policy. Whichever of the two merges second will need a small rebase against the other — this PR's onboarding edits are minimal (drop the now-deadaccessPolicyplumbing) specifically to keep that conflict small.Verification
bun run typecheck— cleanbun run lint— clean (pre-existing unrelated warnings only)bun run check:structural— all checks pass, 217 tests greenpackages/onboardingandpackages/settings-uiunit suites run directly — all greenhttps://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG