Skip to content

docs(platform-objects): re-measure the two better-auth 1.6.11 stamps outside #10188's plugin-auth carrier#11468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-sam merged 1 commit into from
Aug 23, 2026
+18 −11
Merged

docs(platform-objects): re-measure the two better-auth 1.6.11 stamps outside #10188's plugin-auth carrier #11468

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 12 additions & 7 deletions packages/platform-objects/src/identity/sys-oauth-application.object.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -46,14 +46,19 @@ export const SysOauthApplication = ObjectSchema.create({
// is intentionally dropped from `apiMethods` below so the only delete
// path is the better-auth wrapper.
//
// Upstream gap (better-auth 1.6.11): the stock `/admin/oauth2/update-client`
// endpoint's Zod body schema does NOT accept the `disabled` flag, even
// though the column exists and the runtime honours it. We bridge the
// gap with `POST /api/v1/auth/admin/oauth2/toggle-disabled`, registered
// by plugin-auth, which writes through better-auth's own adapter under
// Upstream gap (re-measured 2026-08-23 against the installed
// @better-auth/oauth-provider@1.7.1): `adminUpdateOAuthClient`
// (`dist/authorize-Crqw4_bR.mjs:2860`) declares the stock
// `/admin/oauth2/update-client` endpoint's Zod body schema at
// `:2862-2889`, and `disabled` occurs zero times in that block — while
// matching 35 other lines of the same file (`grep -c`), so the search
// reaches the text. The column exists and the runtime honours it, but
// no client-facing API can flip it there. We bridge the gap with
// `POST /api/v1/auth/admin/oauth2/toggle-disabled`, registered by
// plugin-auth, which writes through better-auth's own adapter under
// the auth namespace (no generic data-layer bypass). When upstream
// ships `disabled` support, retarget the enable/disable actions and
// delete the bridge route.
// adds `disabled` to `adminUpdateOAuthClient`'s schema, retarget the
// enable/disable actions and delete the bridge route.
//
// The two toggle predicates are guarded for the SPARSE action face (#8990),
// and this pair is where the guard actually changes what a user sees. Both
Expand Down
10 changes: 6 additions & 4 deletions packages/platform-objects/src/platform-objects.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -182,10 +182,12 @@ describe('@objectstack/platform-objects', () => {
expect(del?.mode).toBe('delete');

// Enable/disable both hit the ObjectStack-added bridge route on
// /api/v1/auth (since better-auth 1.6.11's stock admin endpoint
// does not accept `disabled` in its update schema). They differ
// only in the static `disabled` body field and the visibility
// predicate, so exactly one is active at any time.
// /api/v1/auth. Re-measured 2026-08-23 against the installed
// @better-auth/oauth-provider@1.7.1: the stock admin endpoint's Zod
// body schema (`dist/authorize-Crqw4_bR.mjs:2862-2889`) still does
// not accept `disabled`, so the bridge route stays warranted. They
// differ only in the static `disabled` body field and the
// visibility predicate, so exactly one is active at any time.
expect(disable?.target).toBe('/api/v1/auth/admin/oauth2/toggle-disabled');
expect(disable?.bodyExtra).toEqual({ disabled: true });
expect((disable?.visible as any)?.source).toBe('(has(record.disabled) && record.disabled != true) && features.oidcProvider != false');
Expand Down
Loading