@@ -0,0 +1,10 @@
+---
+'@object-ui/console': patch
+---
+
+feat(console): the Access policy page shows the address the server judges beside Allowed IP ranges
+
+Clause-②: no
+Metadata-protocol: none
+
+An organization's `access_policy.allowed_ip_ranges` save is refused when the list leaves out the saving request's own address, and until now **Setup → Access policy** told the organization administrator that address only in the refusal. The page now reads `GET /api/v1/auth/client-address` (the organization administrator's read, answered to a caller holding `setup.write` in their current organization) and draws the note the Authentication page already draws under its own Allowed IP ranges: the address, and whether it came from a trusted proxy's forwarded headers or, with `trustProxy` off, from the connection itself (behind a proxy, the proxy's address); when the server cannot establish an address, that a non-empty list cannot be saved from here. The Authentication page keeps reading the platform administrator's route. A caller the route refuses, a server without the route, or any other failed read draws no note and no toast, and the page is otherwise unchanged. No translation key is added: the three existing note sentences are reused.
@@ -25,6 +25,7 @@ import {
   runSettingsAction,
   saveSettingsNamespace,
   type JudgedClientAddress,
+  type JudgedClientAddressRoute,
 } from './api';
 import { resolveLabel, type SettingsNamespacePayload, type Specifier } from './types';
 import { useSettingsLabel, type SettingsLabelHelpers } from './useSettingsLabel';
@@ -52,14 +53,24 @@ function evalVisibility(expr: string | undefined, data: Record<string, unknown>)
 }
 
 /**
- * The row the judged client address is drawn beside (objectstack#30313): the
- * `auth` namespace's Allowed IP ranges. A save of a list that leaves this
+ * The rows the judged client address is drawn beside (objectstack#30313): the
+ * Allowed IP ranges of the deployment (`auth`, platform administrators) and of
+ * an organization (`access_policy`, organization administrators), each with the
+ * route gated to whoever may save that list. A save of a list that leaves this
  * address out is refused (`invalid_value`, `constraint.clientAddress`), so the
  * admin is shown it before saving rather than learning it from the refusal.
  */
-const CLIENT_ADDRESS_NAMESPACE = 'auth';
+const CLIENT_ADDRESS_ROUTES: ReadonlyMap<string, JudgedClientAddressRoute> = new Map<string, JudgedClientAddressRoute>([
+  ['auth', '/admin/client-address'],
+  ['access_policy', '/client-address'],
+]);
 const CLIENT_ADDRESS_KEY = 'allowed_ip_ranges';
 
+/** The judged-address route of `namespace`, or undefined when its page draws no address. */
+function clientAddressRouteOf(namespace: string | undefined): JudgedClientAddressRoute | undefined {
+  return namespace === undefined ? undefined : CLIENT_ADDRESS_ROUTES.get(namespace);
+}
+
 /**
  * The note under Allowed IP ranges, one whole sentence per state so a pack
  * words each its own way: no address the server can establish (any non-empty
@@ -441,20 +452,21 @@ export function SettingsView() {
   }, [namespace]);
 
   /**
-   * The caller's address as the server judges it, on the `auth` page only
-   * (objectstack#30313), or null: not that page, not read yet, or the read
-   * failed. A failure draws no note rather than a guess: the route is
-   * platform-admin gated and absent on a server older than objectstack#30398,
-   * and a refused save still names the address in the row.
+   * The caller's address as the server judges it, on a page that draws it
+   * ({@link CLIENT_ADDRESS_ROUTES}), or null: another page, not read yet, or
+   * the read failed. A failure draws no note rather than a guess: each route is
+   * gated to whoever may save its list and absent on an older server, and a
+   * refused save still names the address in the row.
    */
   const [judgedRead, setJudgedRead] = useState<{
     namespace: string;
     judged: JudgedClientAddress;
   } | null>(null);
   useEffect(() => {
-    if (namespace !== CLIENT_ADDRESS_NAMESPACE) return;
+    const route = clientAddressRouteOf(namespace);
+    if (!namespace || !route) return;
     let live = true;
-    getJudgedClientAddress().then(
+    getJudgedClientAddress(route).then(
       (judged) => {
         if (live) setJudgedRead({ namespace, judged });
       },
@@ -832,7 +844,7 @@ export function SettingsView() {
                 error={key ? fieldErrors[key] : undefined}
                 note={
                   judgedAddress &&
-                  namespace === CLIENT_ADDRESS_NAMESPACE &&
+                  clientAddressRouteOf(namespace) !== undefined &&
                   key === CLIENT_ADDRESS_KEY
                     ? clientAddressNote(judgedAddress, t)
                     : isStoredJsonText(spec, resolved)
 
@@ -233,3 +233,117 @@ describe('SettingsView — Allowed IP ranges shows the address the server judges
     expect(addressReads()).toHaveLength(1);
   });
 });
+
+/**
+ * objectstack#31260 — the organization's Allowed IP ranges (Setup → Access
+ * policy, the `access_policy` namespace) shows the same note, read from the
+ * route an organization administrator may call, `GET /api/v1/auth/client-address`
+ * (gated to `setup.write` in the caller's current organization, the list's own
+ * write permission). Its save check judges the same address the same way, so the
+ * three sentences hold for it unchanged. A refused or failed read leaves the page
+ * as it was: no note and no toast.
+ */
+describe('SettingsView — Access policy shows the address the server judges (objectstack#31260)', () => {
+  const ORG_ADDRESS_URL = '/api/v1/auth/client-address';
+
+  const ACCESS_POLICY = {
+    manifest: {
+      namespace: 'access_policy',
+      version: 1,
+      label: 'Access policy',
+      scope: 'tenant',
+      specifiers: [
+        { type: 'textarea', key: 'allowed_ip_ranges', label: 'Allowed IP ranges', description: 'CIDR ranges.' },
+        { type: 'number', key: 'session_idle_timeout_minutes', label: 'Idle timeout (minutes)' },
+      ],
+    },
+    values: {
+      allowed_ip_ranges: { value: null, source: 'default', locked: false },
+      session_idle_timeout_minutes: { value: null, source: 'default', locked: false },
+    },
+  };
+
+  /** The organization route's reads; the platform route's URL does not end with it. */
+  const orgReads = () => fetchMock.mock.calls.filter(([url]) => String(url).endsWith(ORG_ADDRESS_URL));
+
+  /** Serve the namespace page, and answer the organization route with `address`. */
+  function serveOrg(page: unknown, address: () => Promise<Response>) {
+    fetchMock.mockImplementation(async (url: string) => {
+      if (String(url).endsWith(ORG_ADDRESS_URL)) return address();
+      if (String(url).endsWith(CLIENT_ADDRESS_URL)) return refused(403, 'PERMISSION_DENIED');
+      return ok(page);
+    });
+  }
+
+  it('draws the address under the list with the proxy sentence when trustProxy is off, from the organization route', async () => {
+    serveOrg(ACCESS_POLICY, async () => ok({ clientAddress: '203.0.113.7', trustProxy: false }));
+    renderAt('access_policy');
+
+    const note = await screen.findByTestId('settings-field-note');
+    expect(note.textContent).toBe(sentence('clientAddressDirect', '203.0.113.7'));
+    expect(rowOf('allowed_ip_ranges')!.contains(note)).toBe(true);
+    expect(rowOf('session_idle_timeout_minutes')!.querySelector('[data-testid="settings-field-note"]')).toBeNull();
+    const box = rowOf('allowed_ip_ranges')!.querySelector('textarea')!;
+    expect(box.getAttribute('aria-describedby')).toBe(note.id);
+
+    // One read, at the organization route, with the session cookie; the
+    // platform-admin route is never asked from this page.
+    expect(orgReads()).toHaveLength(1);
+    expect(orgReads()[0][1]).toMatchObject({ credentials: 'include' });
+    expect(addressReads()).toHaveLength(0);
+  });
+
+  it('says the address came through the trusted proxy when trustProxy is on', async () => {
+    serveOrg(ACCESS_POLICY, async () => ok({ clientAddress: '198.51.100.20', trustProxy: true }));
+    renderAt('access_policy');
+
+    const note = await screen.findByTestId('settings-field-note');
+    expect(note.textContent).toBe(sentence('clientAddressViaProxy', '198.51.100.20'));
+  });
+
+  it('says no address could be established when the server answers null', async () => {
+    serveOrg(ACCESS_POLICY, async () => ok({ clientAddress: null, trustProxy: false }));
+    renderAt('access_policy');
+
+    const note = await screen.findByTestId('settings-field-note');
+    expect(note.textContent).toBe(sentence('clientAddressUnknown'));
+  });
+
+  it.each([
+    ['a caller without setup.write (403)', async () => refused(403, 'PERMISSION_DENIED')],
+    ['no session (401)', async () => refused(401, 'UNAUTHENTICATED')],
+    [
+      'a server without the route (404)',
+      async () =>
+        ({
+          ok: false,
+          status: 404,
+          statusText: 'Not Found',
+          json: async () => ({ success: false, error: { code: 'NOT_FOUND', message: 'Not found.' } }),
+        }) as unknown as Response,
+    ],
+    ['a body that is not the declared shape', async () => ok({ trustProxy: false })],
+    ['a network failure', async () => Promise.reject(new TypeError('Failed to fetch'))],
+  ])('leaves the page as it was on %s: no note, no toast', async (_what, answer) => {
+    serveOrg(ACCESS_POLICY, answer);
+    renderAt('access_policy');
+
+    await screen.findByText('Allowed IP ranges');
+    await waitFor(() => expect(orgReads()).toHaveLength(1));
+    // Let the rejected read settle before asserting its absence.
+    await new Promise((r) => setTimeout(r, 0));
+    expect(screen.queryByTestId('settings-field-note')).toBeNull();
+    expect(screen.queryByText(/Failed to load settings/)).toBeNull();
+    expect(toastError).not.toHaveBeenCalled();
+    expect(rowOf('allowed_ip_ranges')!.querySelector('textarea')!.hasAttribute('aria-describedby')).toBe(false);
+  });
+
+  it('the Authentication page still reads the platform route, never the organization one', async () => {
+    serve(AUTH, async () => ok({ clientAddress: '203.0.113.7', trustProxy: false }));
+    renderAt('auth');
+
+    await screen.findByTestId('settings-field-note');
+    expect(addressReads()).toHaveLength(1);
+    expect(orgReads()).toHaveLength(0);
+  });
+});
@@ -214,9 +214,10 @@ export async function runSettingsAction(
 
 /**
  * The caller's address as the server judges it (objectstack#30313), read from
- * `GET /api/v1/auth/admin/client-address` (objectstack#30398).
+ * one of two routes that answer it alike ({@link JudgedClientAddressRoute}).
  *
- * `clientAddress` is the address the `auth.allowed_ip_ranges` save check and
+ * `clientAddress` is the address the `allowed_ip_ranges` save checks (the
+ * deployment's `auth` list and an organization's `access_policy` list) and
  * the sign-in gate judge this connection by (the save check's own call), or
  * `null` when the server cannot establish one. `trustProxy` says whether
  * forwarded headers counted (`server.trustProxy`). ⛔ The console never works
@@ -231,13 +232,22 @@ export interface JudgedClientAddress {
 const AUTH_BASE = `${SERVER_URL}/api/v1/auth`;
 
 /**
- * Read {@link JudgedClientAddress}. The route is platform-admin gated, so a
- * caller who is not one is refused (`401`/`403`) and this throws like any other
+ * The route under `/api/v1/auth` a page reads the judged address from, each
+ * gated to whoever may save the list it informs: `/admin/client-address` to a
+ * platform administrator (the `auth` namespace), `/client-address` to a caller
+ * holding `setup.write` in their current organization (the `access_policy`
+ * namespace).
+ */
+export type JudgedClientAddressRoute = '/admin/client-address' | '/client-address';
+
+/**
+ * Read {@link JudgedClientAddress} from `route`. A caller the route's gate
+ * refuses (`401`/`403`), or a server without the route, throws like any other
  * failed read; so does a body that is not the declared shape. The caller
  * decides what a failure shows.
  */
-export async function getJudgedClientAddress(): Promise<JudgedClientAddress> {
-  const res = await fetch(`${AUTH_BASE}/admin/client-address`, {
+export async function getJudgedClientAddress(route: JudgedClientAddressRoute): Promise<JudgedClientAddress> {
+  const res = await fetch(`${AUTH_BASE}${route}`, {
     credentials: 'include',
     headers: { Accept: 'application/json' },
   });
@@ -250,7 +260,7 @@ export async function getJudgedClientAddress(): Promise<JudgedClientAddress> {
     !(address === null || (typeof address === 'string' && address.length > 0))
   ) {
     throw new Error(
-      'Malformed response from GET /api/v1/auth/admin/client-address: expected an object carrying `clientAddress` (a string or null) and `trustProxy` (a boolean).',
+      `Malformed response from GET /api/v1/auth${route}: expected an object carrying \`clientAddress\` (a string or null) and \`trustProxy\` (a boolean).`,
     );
   }
   return { clientAddress: address, trustProxy: body.trustProxy };