From b537844aa40467248154b5a0982d40853ea3cc7b Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 04:27:33 +0000 Subject: [PATCH] refactor(plugin-auth): remove the inert AUTH_SCIM_PROVIDER_SCHEMA export `AUTH_SCIM_PROVIDER_SCHEMA` was a publicly exported `scimProvider` column mapping with zero consumers -- exactly one repo-wide hit, its own declaration -- and inert by construction: `@better-auth/scim` hardcodes its model and exposes no `schema` option (still true of the installed `@better-auth/scim@1.7.0-rc.1`, whose `SCIMOptions` declares no `schema` / `modelName` / `fields` member), so there was nowhere to hand it. Removed under ADR-0049 enforce-or-remove: it was a second source of truth for the four SCIM column names, where the load-bearing one is the adapter layer (`AUTH_MODEL_TO_PROTOCOL` + camelCase-to-snake_case field resolution in `objectql-adapter.ts`) over the `sys_scim_provider` platform object. A dead copy cannot fail when it drifts, and the next reader cannot tell which of the two is authoritative. A NOTE in its place records why no mapping exists and what owns the names instead, following the sibling sso NOTE in the same file. Fixes #11777 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01APWX2AwT3a4xDcjPCe8bk4 --- .../retire-auth-scim-provider-schema.md | 13 +++++ .../plugin-auth/src/auth-schema-config.ts | 48 +++++++------------ 2 files changed, 30 insertions(+), 31 deletions(-) create mode 100644 .changeset/retire-auth-scim-provider-schema.md diff --git a/.changeset/retire-auth-scim-provider-schema.md b/.changeset/retire-auth-scim-provider-schema.md new file mode 100644 index 0000000000..5f76c96322 --- /dev/null +++ b/.changeset/retire-auth-scim-provider-schema.md @@ -0,0 +1,13 @@ +--- +'@objectstack/plugin-auth': minor +--- + +**BREAKING (public export removed):** `AUTH_SCIM_PROVIDER_SCHEMA` no longer exists. It was a `scimProvider` column mapping exported from `@objectstack/plugin-auth` (via `export * from './auth-schema-config.js'`) that nothing ever read — one repo-wide hit, its own declaration — and that nothing ever could: `@better-auth/scim` hardcodes its model and exposes no `schema` option, still true of the installed `@better-auth/scim@1.7.0-rc.1`, whose `SCIMOptions` declares no `schema`, `modelName` or `fields` member at all. Its sibling constants in the same file are genuinely passed to their plugins; this one had nowhere to go, by construction and by its own doc comment. + +Removed under ADR-0049 enforce-or-remove, because it was a **second source of truth** for the same four column names. The load-bearing one is the adapter layer — `AUTH_MODEL_TO_PROTOCOL` plus the mechanical camelCase-to-snake_case field resolution in `objectql-adapter.ts`, over the `sys_scim_provider` platform object that declares the columns — and it is pinned by the dedicated sso/scim block in `better-auth-schema-parity.test.ts`. A dead copy is worse than none: nothing fails when it drifts from the live names, and the next reader cannot tell which of the two is authoritative. A comment in its place records why no such mapping exists and what owns the names instead, so it is not re-added. + +Behaviour is unchanged. No SCIM column name, platform object, adapter mapping or wire shape moves. + +Breaking ships as `minor` per the launch-window convention (`scripts/check-changeset-no-major.mjs`). + + diff --git a/packages/plugins/plugin-auth/src/auth-schema-config.ts b/packages/plugins/plugin-auth/src/auth-schema-config.ts index 06cba71d54..e37a685898 100644 --- a/packages/plugins/plugin-auth/src/auth-schema-config.ts +++ b/packages/plugins/plugin-auth/src/auth-schema-config.ts @@ -980,37 +980,23 @@ export const AUTH_SSO_PROVIDER_SCHEMA = { // SCIM plugin – scimProvider table (@better-auth/scim) // --------------------------------------------------------------------------- -/** - * `@better-auth/scim` plugin `scimProvider` model mapping. - * - * Each row is a SCIM connection: a bearer token an external IdP (Okta / Entra) - * uses to auto-provision / deprovision THIS environment's users — the env is - * the SCIM Service Provider (ADR-0071). This plugin hardcodes its model and - * exposes NO `schema` option — still true of the installed - * `@better-auth/scim@1.7.0-rc.1` (`SCIMOptions` declares no `schema` / - * `modelName` / `fields` member at all; measured 2026-08-19). It is no longer - * true of `@better-auth/sso@1.7.1`, which this doc used to lean on for the - * comparison and which now accepts one (#8224). So for scim — and for scim - * alone — the ADAPTER layer (AUTH_MODEL_TO_PROTOCOL + field resolution in - * objectql-adapter.ts) is the only available route: the mapping cannot be - * handed to the plugin. - * - * | camelCase (better-auth) | snake_case (ObjectStack) | - * |:------------------------|:-------------------------| - * | providerId | provider_id | - * | scimToken | scim_token | - * | organizationId | organization_id | - * | userId | user_id | - */ -export const AUTH_SCIM_PROVIDER_SCHEMA = { - modelName: 'sys_scim_provider', - fields: { - providerId: 'provider_id', - scimToken: 'scim_token', - organizationId: 'organization_id', - userId: 'user_id', - }, -} as const; +// NOTE: there is intentionally no `scimProvider` mapping constant here, and no +// `buildScimPluginSchema()`. `@better-auth/scim` hardcodes its model and exposes +// NO `schema` option — still true of the installed `@better-auth/scim@1.7.0-rc.1` +// (`SCIMOptions` declares no `schema` / `modelName` / `fields` member at all; +// measured 2026-08-19), so there is nowhere to hand one. This is no longer true +// of `@better-auth/sso@1.7.1`, which now accepts one (#8224) — for scim, and for +// scim alone, the ADAPTER layer is the only available route. +// +// `sys_scim_provider`'s column names are therefore owned by that adapter layer +// alone: AUTH_MODEL_TO_PROTOCOL + the camelCase → snake_case field resolution in +// objectql-adapter.ts, pinned by the sso/scim block in +// better-auth-schema-parity.test.ts. A copy of those names here would be a +// SECOND declaration of one contract that nothing reads and nothing enforces — +// it could drift from the live one with every gate green, and the next reader +// could not tell which was authoritative (ADR-0049 enforce-or-remove). Do not +// re-add one unless the plugin grows a `schema` option AND it is passed there. +// See ADR-0071. // --------------------------------------------------------------------------- // Helper: build device-authorization plugin schema option