From 6dce4a48cd4e9c81e1aeb2def262e246550d7803 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 23:27:51 +0000 Subject: [PATCH] test(plugin-auth): register the production object set in the two SCIM harnesses MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every OAuth object, so the oauth-provider's `session.delete.before` hook — which reads `sys_oauth_access_token` and `sys_oauth_refresh_token` by `sessionId` on every session revocation — hit tables that were never created and logged a Better Auth ERROR on a green run. Import `authIdentityObjects` from the plugin's own manifest instead of re-spelling it. That is the same array `auth-plugin.ts` registers at runtime and `objectstack.config.ts` declares at compile time, so the harness cannot drift from a real deployment by construction. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8 --- .../scim-deactivation-reconcile-user.test.ts | 53 +++++-------------- .../src/scim-transaction-scope.test.ts | 47 +++------------- 2 files changed, 19 insertions(+), 81 deletions(-) diff --git a/packages/plugins/plugin-auth/src/scim-deactivation-reconcile-user.test.ts b/packages/plugins/plugin-auth/src/scim-deactivation-reconcile-user.test.ts index 66be354551..8486a7f954 100644 --- a/packages/plugins/plugin-auth/src/scim-deactivation-reconcile-user.test.ts +++ b/packages/plugins/plugin-auth/src/scim-deactivation-reconcile-user.test.ts @@ -61,27 +61,8 @@ import { describe, it, expect, afterEach } from 'vitest'; import { ObjectQL } from '@objectstack/objectql'; import { SqlDriver } from '@objectstack/driver-sql'; import { ADMIN_FULL_ACCESS } from '@objectstack/spec/identity'; -import { - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, - SysScimConnectionBinding, - SysScimConnectionCredential, - SysScimGroup, - SysScimGroupMember, - SysScimIdentityTombstone, - SysScimProjectionGrant, - SysScimSubject, - SysScimUser, - SysJwks, -} from '@objectstack/platform-objects'; import { AuthManager } from './auth-manager.js'; +import { authIdentityObjects } from './manifest.js'; import { createTenancyService } from './tenancy-service.js'; import { mintScimConnectionCredential } from './scim-connection-service.js'; import { registerLastAdminGuard, type LastAdminGuardEngine } from './last-admin-guard.js'; @@ -102,27 +83,17 @@ const SCIM_ERROR_SCHEMA = 'urn:ietf:params:scim:api:messages:2.0:Error'; /** Every read below is a safety-proof read, never RLS-scoped to a caller. */ const SYSTEM = { context: { isSystem: true } } as const; -/** The identity surface the org + admin (forced by SCIM) + scim plugins touch. */ -const AUTH_OBJECTS = [ - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, - SysScimConnectionBinding, - SysScimConnectionCredential, - SysScimGroup, - SysScimGroupMember, - SysScimIdentityTombstone, - SysScimProjectionGrant, - SysScimSubject, - SysScimUser, - SysJwks, -]; +/** + * The objects a deployment that mounts plugin-auth registers, imported from the + * plugin's own manifest rather than re-spelled here, so this harness cannot + * drift from what `auth-plugin.ts` registers at runtime (#14615). The + * hand-written list this replaced omitted the OAuth objects, and the + * oauth-provider's `session.delete.before` hook reads two of them + * (`sys_oauth_access_token`, `sys_oauth_refresh_token`) on every session + * revocation — which made every revocation this suite drives log a Better Auth + * ERROR about a missing table. + */ +const AUTH_OBJECTS = authIdentityObjects; /** * The two tables the break-glass guard enumerates platform administrators diff --git a/packages/plugins/plugin-auth/src/scim-transaction-scope.test.ts b/packages/plugins/plugin-auth/src/scim-transaction-scope.test.ts index b2c01f1d01..ee68073bd9 100644 --- a/packages/plugins/plugin-auth/src/scim-transaction-scope.test.ts +++ b/packages/plugins/plugin-auth/src/scim-transaction-scope.test.ts @@ -54,27 +54,8 @@ import { describe, it, expect, afterEach, vi } from 'vitest'; import { ObjectQL } from '@objectstack/objectql'; import { SqlDriver } from '@objectstack/driver-sql'; -import { - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, - SysScimConnectionBinding, - SysScimConnectionCredential, - SysScimGroup, - SysScimGroupMember, - SysScimIdentityTombstone, - SysScimProjectionGrant, - SysScimSubject, - SysScimUser, - SysJwks, -} from '@objectstack/platform-objects'; import { AuthManager } from './auth-manager.js'; +import { authIdentityObjects } from './manifest.js'; import { createTenancyService } from './tenancy-service.js'; import { inScimRequestScope, mintScimConnectionCredential } from './scim-connection-service.js'; @@ -92,26 +73,12 @@ const SYSTEM = { context: { isSystem: true } } as const; /** The identity objects a SCIM provisioning request touches. */ const IDENTITY_OBJECTS = ['sys_user', 'sys_scim_subject', 'sys_scim_user'] as const; -const AUTH_OBJECTS = [ - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, - SysScimConnectionBinding, - SysScimConnectionCredential, - SysScimGroup, - SysScimGroupMember, - SysScimIdentityTombstone, - SysScimProjectionGrant, - SysScimSubject, - SysScimUser, - SysJwks, -]; +/** + * The objects a deployment that mounts plugin-auth registers, imported from the + * plugin's own manifest rather than re-spelled here, so this harness cannot + * drift from what `auth-plugin.ts` registers at runtime (#14615). + */ +const AUTH_OBJECTS = authIdentityObjects; const engines: ObjectQL[] = []; afterEach(async () => {