Repository navigation
feat(api): a deployment can serve mainnet only - #2875
Merged
Merged
Conversation
`SDP_ALLOW_SANDBOX_PROJECTS=false` is the mirror of `SDP_ALLOW_PRODUCTION_PROJECTS`. The deployment hides and refuses every sandbox project (edge and money admission), creates none for a new organization, registers no sandbox cron work, and admits only organizations with mainnet access: the others may read their organization, projects and members and request mainnet access, and every other action answers 403 `organization_not_admitted`. A deployment that admits no production project (the sandbox) takes no mainnet requests: the mainnet-access read says `sandboxOnly`, and a request is refused. The read also says `mainnetOnly` for the dashboard. Unset keeps today's behavior; both settings false fails at boot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
Contributor
|
React Doctor found no new issues. 🎉 Reviewed by React Doctor for commit |
…ting The "Mainnet enabled" email answers the organization's own request, and the mainnet request page promises it. It now reads as a welcome (open the dashboard, start with the production project) instead of a change to review, and it and "Mainnet disabled" are sent even when the organization turned alert emails off, like the alert about that setting itself. Also: a test that an organization without mainnet access on a mainnet-only deployment cannot send feedback, and the cutover runbook (docs/ops/beta-cutover.md). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Windscar
marked this pull request as ready for review
November 13, 2026 02:32
Contributor
 [High impact] The reviewed changes appear safe to merge, with no new actionable issues established. SummaryAdds
Reviews (4) · Last reviewed commit: "docs(ops): grant the canary org mainnet ..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
On a deployment that serves mainnet only, the dashboard decides from this read where a member lands: their Production project, or the mainnet request page. It required organizations.manage, so members and viewers got a refusal and waited on the loading page. The read now takes organizations.read, checked before the human-session check so an API key holding it is still refused; requesting and resending stay admin-only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ocked orgs Review on the mainnet-only organization lock: - An organization that lost mainnet access kept its Earn reads and exits at project scope (ADR 0002), but the lock then refused them. The project check that admits the exit now marks the request exempt, and requireAction honors that one mark. - The lock exempted every organizations.manage route, so a locked organization could still rename itself or change its IP allowlist and alert setting. Only the mainnet-access request and resend now mark themselves exempt. - The Earn catalogue sync fetched and wrote the sandbox shelf on a deployment that serves mainnet only; it now skips the sandbox lanes there. - The lock tests parse responses with schemas and cover all three. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…owner notice Clerk CAPTCHA is not required: Vercel bot protection covers both dashboards. The README names the hosted sandbox on platform-beta. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
multipletwigs
approved these changes
Nov 13, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SDP_ALLOW_SANDBOX_PROJECTS=false(the mirror ofSDP_ALLOW_PRODUCTION_PROJECTS) makes a deployment mainnet-only. Unset keeps today's behavior, so this changes nothing on any deployment until infra sets it.reason: "organization_not_admitted", checked inrequireAction. Invitations are refused too, so unapproved orgs can't send prod Clerk invitations.sandboxOnlyandmainnetOnlyfor the dashboard, and every signed-in member may read it (organizations.read; requests stay admin-only), since the dashboard decides from it where a member lands. Its parse defaults both to false for older API revisions.falsefails at boot.docs/ops/beta-cutover.md.Verification: API typecheck; API suite 9216 passed, plus the 2 files edited mid-run, 44/44 on rerun; new
mainnet-only-deployment.test.tssweeps every project route with a sandbox project; web typecheck and mainnet-access tests 74/74; docs check:prose and check:links pass. Local QA on a mainnet-only stack (results in the release test plan): lock, refusals, request and approval pass.Part of PRO-2436 and PRO-2477.
🤖 Generated with Claude Code