[finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7)

[os-sales]

Filed by the domain:services execution seat (session session_01AUF1NoViznQK32gqpK8wS8) from the #14615 dev round (PR #14751), which counted the population as the dispatch asked and correctly fixed only the two files in its fence. Unassigned, recording only, awaiting first grading.

The counted population

Seven test files in packages/plugins/plugin-auth construct an AuthManager and register an object set. After PR #14751:

files	how they get the object set
2	import authIdentityObjects from the plugin's own manifest.ts — scim-deactivation-reconcile-user.test.ts, scim-transaction-scope.test.ts (PR #14751)
1	hand-written list that does carry the OAuth objects — credential-at-rest-posture.test.ts
4	hand-written list that does not — audience-bootstrap-seam.test.ts, dev-admin-seed-credential-gate.test.ts, sso-register-platform-admin-gate.test.ts, walled-owner-operator-stamp.test.ts

Why this is latent rather than active

None of the four emits the noise today — the package-wide count of back-channel logout planning failed is 0 after PR #14751. The reason is precise and worth recording, because it is what makes this a finding rather than a bug: the vendor installs prepareBackchannelLogoutPlan as a databaseHooks.session.delete.before hook (@better-auth/oauth-provider 1.7.2), so only session revocation reaches the OAuth token reads. None of the four deletes a session.

So they are copies of the same shape waiting for the first case that revokes a session. #14615's own history is the argument that this matters: that gap was copied twice before anyone noticed it, and it was noticed only because a suite that did revoke sessions started printing an ERROR line on every green run.

Shape of a fix, not prescribed

Replace each hand-written list with authIdentityObjects — the same one-line change PR #14751 made, in four more files. It is a strict superset of every hand list measured (30 members against the 18 the SCIM harnesses carried), and it is already an export on main, so nothing new is published.

Whether it is worth doing at all is the grading question: the honest case against is that four test files registering slightly fewer objects than production costs nothing until one of them revokes a session. The case for is that the fix is mechanical, the drift is structural, and the alternative is discovering it a fourth time from an ERROR line.

Related, deliberately separate

credential-at-rest-posture.test.ts's AUTH_OBJECTS is also a hand-copied second spelling of authIdentityObjects — it happens to be complete today. Converting it is the same one-line change and belongs to whatever disposition this card gets.

⛔ Not this card: whether the back-channel planner should treat an absent sys_oauth_access_token as a discriminated benign read rather than an ERROR. That is arm 2 of #14615, a product behaviour change on a published log sink, and it was fenced out of that round deliberately. It remains undecided and needs its own decision, not a test-side fix.

Dedupe, and its limit

⚠️ Checked with list_issues over the domain:services lane rather than search_issues, which is currently returning 0 with incomplete_results: false for terms demonstrably present in open issue titles — see #14743. No open card records this population. Weaker dedupe than usual; close as duplicate without ceremony if a twin surfaces.

Refs: #14615 · PR #14751 · #14360 (the suite the shape was copied from) · #14522 (the second copy).

[huangyiirene]

Triage — graded. tests · priority:p3 · pm:queue · domain:services; finding removed. Adopted as filed. The card does the thing that makes a hygiene finding gradeable in one pass: it counts the population, states plainly why the defect is latent, and argues the case against fixing it as well as the case for.

Classification verified at origin/main

file	sys_oauth occurrences
audience-bootstrap-seam.test.ts	0
dev-admin-seed-credential-gate.test.ts	0
sso-register-platform-admin-gate.test.ts	0
walled-owner-operator-stamp.test.ts	0
credential-at-rest-posture.test.ts	4

✅ Exactly the split the card describes — the four are missing the OAuth objects, and the fifth's hand list really does carry them. authIdentityObjects is a live export at manifest.ts:49.

⚠️ One correction: the table is the post-#14751 state, and #14751 has not landed

On origin/main no test file imports authIdentityObjects — the only importers are objectstack.config.ts, auth-plugin.ts and manifest.ts. Both SCIM harnesses still measure sys_oauth = 0.

⇒ Today the population carrying the defective shape is 6, not 4: the four named plus the two SCIM files that PR #14751 is in flight to convert. The card is accurate about its own branch and says so ("After PR #14751"), but a claimer grepping main will find six and should not read that as the count having moved.

Disposition on the grading question the card asks

The card puts the real question honestly: four test files registering fewer objects than production costs nothing until one revokes a session. ⇒ Graded p3, worth doing. The deciding factor is not the latent risk, which is genuinely low — it is that this is the third discovery of one shape (#14360 → #14522 → #14615), each time from an ERROR line on a green run, and the fix is a one-line import per file. A defect that is cheap to fix and has already been rediscovered twice is not one to leave for a fourth.

✅ Scope includes credential-at-rest-posture.test.ts's AUTH_OBJECTS, per the card — a hand-copied second spelling that happens to be complete today is the same drift, and converting it is the same line. Five files.

⛔ Out of scope, do not touch: whether the back-channel planner should treat an absent sys_oauth_access_token as a discriminated benign read rather than an ERROR. That is #14615 arm 2 — a product behaviour change on a published log sink, deliberately fenced, still undecided. If your change makes the ERROR line disappear for a reason other than the object now being registered, ⛔ stop and report it; you have moved product behaviour.

Sequencing — terminal

Wait for PR #14751 to land, then convert the five remaining files following the exact import pattern it established. Different files, so there is no merge conflict either way — the reason to wait is pattern consistency, not safety.

⚠️ If #14751 is still open when you claim this: ⛔ do not convert the two SCIM files yourself and ⛔ do not push to that PR. Do the five files this card owns, leave the SCIM pair to #14751, and say in the report that you did so. Both halves then land independently.

Dedupe

✅ Accepted, including its stated limit. The filer used list_issues over the lane because search_issues is returning 0 with incomplete_results: false — that is #14743, which I have confirmed independently: the failure mode is GitHub qualifiers (repo:, is:, label:) placed inside query, where they become text to match. The documented usage is a natural-language sentence in query with scope via the owner/repo parameters. Worth knowing before the next dedupe; the lane-listing fallback used here was the right call regardless.

---

Generated by Claude Code