From 05bfc3eb34cb9e208d3f886e0ee17910a9c30154 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 23 Aug 2026 21:02:28 +0000
Subject: [PATCH] docs(platform-objects): re-measure the two better-auth 1.6.11
 stamps outside #10188's plugin-auth carrier

Both sites stamp the same upstream-gap claim as #10188's plugin-auth site 1 (the
stock /admin/oauth2/update-client endpoint's Zod body schema does not accept
`disabled`). Nothing was broken: both claims are still TRUE, only the stamps
(and, for site 1, the anchor) were stale. Re-measured 2026-08-23 against
installed @better-auth/oauth-provider@1.7.1, independently of #10188/#11446's
own re-measurement.

Fixes #11362

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01APWX2AwT3a4xDcjPCe8bk4
---
 .../identity/sys-oauth-application.object.ts  | 19 ++++++++++++-------
 .../src/platform-objects.test.ts              | 10 ++++++----
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/packages/platform-objects/src/identity/sys-oauth-application.object.ts b/packages/platform-objects/src/identity/sys-oauth-application.object.ts
index a6161369a7..1ead044ed5 100644
--- a/packages/platform-objects/src/identity/sys-oauth-application.object.ts
+++ b/packages/platform-objects/src/identity/sys-oauth-application.object.ts
@@ -46,14 +46,19 @@ export const SysOauthApplication = ObjectSchema.create({
   // is intentionally dropped from `apiMethods` below so the only delete
   // path is the better-auth wrapper.
   //
-  // Upstream gap (better-auth 1.6.11): the stock `/admin/oauth2/update-client`
-  // endpoint's Zod body schema does NOT accept the `disabled` flag, even
-  // though the column exists and the runtime honours it. We bridge the
-  // gap with `POST /api/v1/auth/admin/oauth2/toggle-disabled`, registered
-  // by plugin-auth, which writes through better-auth's own adapter under
+  // Upstream gap (re-measured 2026-08-23 against the installed
+  // @better-auth/oauth-provider@1.7.1): `adminUpdateOAuthClient`
+  // (`dist/authorize-Crqw4_bR.mjs:2860`) declares the stock
+  // `/admin/oauth2/update-client` endpoint's Zod body schema at
+  // `:2862-2889`, and `disabled` occurs zero times in that block — while
+  // matching 35 other lines of the same file (`grep -c`), so the search
+  // reaches the text. The column exists and the runtime honours it, but
+  // no client-facing API can flip it there. We bridge the gap with
+  // `POST /api/v1/auth/admin/oauth2/toggle-disabled`, registered by
+  // plugin-auth, which writes through better-auth's own adapter under
   // the auth namespace (no generic data-layer bypass). When upstream
-  // ships `disabled` support, retarget the enable/disable actions and
-  // delete the bridge route.
+  // adds `disabled` to `adminUpdateOAuthClient`'s schema, retarget the
+  // enable/disable actions and delete the bridge route.
   //
   // The two toggle predicates are guarded for the SPARSE action face (#8990),
   // and this pair is where the guard actually changes what a user sees. Both
diff --git a/packages/platform-objects/src/platform-objects.test.ts b/packages/platform-objects/src/platform-objects.test.ts
index bced5be6e3..4b3f8e40a5 100644
--- a/packages/platform-objects/src/platform-objects.test.ts
+++ b/packages/platform-objects/src/platform-objects.test.ts
@@ -182,10 +182,12 @@ describe('@objectstack/platform-objects', () => {
       expect(del?.mode).toBe('delete');
 
       // Enable/disable both hit the ObjectStack-added bridge route on
-      // /api/v1/auth (since better-auth 1.6.11's stock admin endpoint
-      // does not accept `disabled` in its update schema). They differ
-      // only in the static `disabled` body field and the visibility
-      // predicate, so exactly one is active at any time.
+      // /api/v1/auth. Re-measured 2026-08-23 against the installed
+      // @better-auth/oauth-provider@1.7.1: the stock admin endpoint's Zod
+      // body schema (`dist/authorize-Crqw4_bR.mjs:2862-2889`) still does
+      // not accept `disabled`, so the bridge route stays warranted. They
+      // differ only in the static `disabled` body field and the
+      // visibility predicate, so exactly one is active at any time.
       expect(disable?.target).toBe('/api/v1/auth/admin/oauth2/toggle-disabled');
       expect(disable?.bodyExtra).toEqual({ disabled: true });
       expect((disable?.visible as any)?.source).toBe('(has(record.disabled) && record.disabled != true) && features.oidcProvider != false');