[objectstack-fleet]

Requested by Bill · project thread

domain:server#2 · os-bill · session_01Utp6CZhiLoN3MZGp7ZnqCg

Fixes #30570

Clause-②: no — docs only
Metadata-protocol: none

维护者速读

• 改了什么：authentication.mdx 的「Saving, clearing and lockout recovery」加一条，写明 Setup → Authentication 在「允许的 IP 段」字段下显示服务器判定的本次请求地址，数据来自 GET /api/v1/auth/admin/client-address（仅平台管理员），并说明三种提示各指什么。
• 为什么改：Allowed IP ranges: no route serves the caller's address as the server resolves it, so the console cannot show an admin which address the lock-out check will judge before they save #30398（接口）和 Allowed IP ranges console field: show the caller's current address before saving, and show the refusal's address when a save would lock the admin out #30313（控制台提示，PR feat(console): Allowed IP ranges shows the address the server judges before a save #30540）都已落地，文档却只讲了保存被拒时才告诉你地址，没说保存前在哪能看到。
• 风险与回滚：纯文档，一个文件加 8 行，不动任何代码或发布面；措辞逐句对过 main 上控制台的英文文案。回滚即撤本 PR。
• 先看：content/docs/permissions/authentication.mdx 新增的「Setup shows your address before you save.」一条。
• 两分钟验证：打开 PR 的 Files changed，对照 ui/packages/i18n/src/locales/en.ts 的 clientAddressDirect / clientAddressViaProxy / clientAddressUnknown 三句，预期文档描述与三句一一对应、无多说。
• 需要你做的：无，席位落地。

What changes

One new bullet in Saving, clearing and lockout recovery (chosen over the allowed_ip_ranges table row: the row already defers the save behaviour to that section, and the note is about what you see before a save, so it sits next to the save rule it previews):

Setup shows your address before you save. Under the field, Setup → Authentication shows the address the server judges for your request, read from GET /api/v1/auth/admin/client-address (platform administrators only), which answers { clientAddress, trustProxy }: the note says whether that address came from the forwarded headers of a proxy the server trusts (server.trustProxy) or from the connection itself, which behind a proxy it does not trust is the proxy's own address, and when clientAddress is null it says instead that no non-empty list can be saved.

Checked against main at db04e5ce, which carries PR #30540 (b6f4c0e8b7):

• ui/apps/console/src/pages/settings/SettingsView.tsx clientAddressNote: three states, clientAddress === null → clientAddressUnknown, trustProxy → clientAddressViaProxy, else clientAddressDirect; drawn only on the auth namespace under allowed_ip_ranges.
• ui/packages/i18n/src/locales/en.ts: clientAddressDirect ("…This server does not trust proxy headers, so behind a proxy this is the proxy's address."), clientAddressViaProxy ("…read from the forwarded headers of the proxy this server trusts…"), clientAddressUnknown ("The server cannot establish your address, so a non-empty list cannot be saved from here.").
• packages/plugins/plugin-auth/src/client-address-read.ts: 200 { success: true, data: { clientAddress, trustProxy } }, clientAddress null when no address can be established, gateAdmin (platform admin), Cache-Control: no-store.

Not said, because the console does not do it: no note is drawn when the read fails (non-admin, older server); the page does not claim one. No other sentence on the page is made false by the read: the allowed_ip_ranges row and the refusal bullet stay true as written.

Changeset: none. Followed AGENTS.md Post-Task Checklist step 3 and os-dev's rule: skip-changeset is for a diff that publishes nothing from any released package; content/docs/** is in no package's files[] (the repo's own negative control in scripts/check-changeset-no-major.mjs names content/docs/** as publishing nothing). Label skip-changeset rides this create.

Verification

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack content/docs/permissions/authentication.mdx: 45 commands. All 45 exit 0 at head 115efa0e; five first exited 3 (prerequisite: @objectstack/spec, @objectstack/lint, @objectstack/formula, @objectstack/client-react not built) and were re-run green after turbo run build of those closures. --ran reconciliation: 45 derived, 45 run, 0 NOT-MEASURED, 0 UNRUN.
• Not run locally, left to CI: the Build Docs job and the type-check lanes dispatch-gates lists as CI-only.
• Dogfood: not run (docs only, no !, no narrowing arm).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Utp6CZhiLoN3MZGp7ZnqCg

---

Generated by Claude Code

[objectstack-fleet]

domain:server#2 · os-bill · session_01Utp6Cbvcmv8YWFhFJwzjKL

维护者速读

• 改了什么： 认证文档「保存、清空与锁定恢复」一节加一条：设置页在「允许的 IP 段」下会显示服务器判定的本次请求地址，数据来自 GET /api/v1/auth/admin/client-address，并说明三种提示各指什么。
• 为什么改： 接口（Allowed IP ranges: no route serves the caller's address as the server resolves it, so the console cannot show an admin which address the lock-out check will judge before they save #30398）和控制台提示（Allowed IP ranges console field: show the caller's current address before saving, and show the refusal's address when a save would lock the admin out #30313）都已落地，文档只讲了保存被拒时才告诉你地址，没讲保存前在哪能看到。
• 风险与回滚： 纯文档，一个文件加 8 行，不动代码。回滚即撤本 PR。
• 先看： content/docs/permissions/authentication.mdx 新增的「Setup shows your address before you save.」一条。
• 两分钟验证： 对照 ui/packages/i18n/src/locales/en.ts 的 clientAddressDirect / clientAddressViaProxy / clientAddressUnknown 三句。
• 需要您做的： 无，席位经合并队列落地（非受管面，8 行）。
• 席位意见： ACCEPT。席位逐句对过接口和控制台三句文案，文档没有多说控制台不做的事。

席位核对 — ACCEPT · domain:server#2 · head 115efa0e498655e7214b2269fdb232e42a73e08e

• 形态: draft, author objectstack-fleet[bot] (relay pr_create), no assignee, no review request; 1 file, +8 −0; labels documentation, skip-changeset; check-governed-merges --pr 30582: NOT governed. Title has no !. Fixes #30570.
• Review face: TIER_DEFAULT (Clause-②: no, docs only), written here by the seat.
• Seat read: the new bullet sits in "Saving, clearing and lockout recovery", next to the save rule it previews (the allowed_ip_ranges row already defers there). Checked on main: client-address-read.ts answers { clientAddress, trustProxy } with clientAddress null when no address can be established (L100), Cache-Control: no-store, platform-admin gate; en.ts L2368–2370 carry the three notes the bullet describes (direct / via trusted proxy / unknown). Nothing on the page becomes false.
• 偏差: none. Pins: none (docs). Declarations: Clause-②: no, Metadata-protocol: none at line start.
• Dev readings (115efa0e): dispatch-gates 45/45 exit 0, --ran 0 not measured; no dogfood (docs only, per the order). os-dev-report 6663603111.
• 门禁 check-runs: in progress at ACCEPT; the seat queues once every check is green or an expected skip.
• 落地条款: Fixes docs(authentication): the allowed IP ranges row does not say that Setup now shows the address the server judges for you #30570. Ordinary queue landing by this seat: pr_ready + automerge_enable on this head.