From 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 04:44:32 +0000 Subject: [PATCH] test(plugin-auth): import the registered object set from the manifest in five harnesses Five plugin-auth harnesses re-spelled the objects a deployment mounting plugin-auth registers, instead of importing `authIdentityObjects` from `src/manifest.ts`. Every hand list had drifted below the manifest, so each harness booted an engine missing tables the runtime registers. Follows the import pattern established by #14751 on the two SCIM harnesses. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8 --- .../src/audience-bootstrap-seam.test.ts | 29 +++------- .../src/credential-at-rest-posture.test.ts | 57 +++---------------- .../dev-admin-seed-credential-gate.test.ts | 29 +++------- .../sso-register-platform-admin-gate.test.ts | 26 +++------ .../src/walled-owner-operator-stamp.test.ts | 29 +++------- 5 files changed, 37 insertions(+), 133 deletions(-) diff --git a/packages/plugins/plugin-auth/src/audience-bootstrap-seam.test.ts b/packages/plugins/plugin-auth/src/audience-bootstrap-seam.test.ts index 83ad5e0690..f77cb0702d 100644 --- a/packages/plugins/plugin-auth/src/audience-bootstrap-seam.test.ts +++ b/packages/plugins/plugin-auth/src/audience-bootstrap-seam.test.ts @@ -61,35 +61,20 @@ import { describe, it, expect, afterEach } from 'vitest'; import { ObjectQL } from '@objectstack/objectql'; import { SqlDriver } from '@objectstack/driver-sql'; import { AuthManager } from './auth-manager.js'; +import { authIdentityObjects } from './manifest.js'; import { SELF_REGISTRATION_CLOSED, isHumanUserRow } from './audience-posture.js'; -import { - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, -} from '@objectstack/platform-objects'; const BASE = 'http://localhost:3000'; const AUTH = `${BASE}/api/v1/auth`; const SECRET = 'test-secret-at-least-32-chars-long-11767'; const PASSWORD = 'S3cure!Passw0rd-11767'; -const AUTH_OBJECTS = [ - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, -]; +/** + * The objects a deployment that mounts plugin-auth registers, imported from the + * plugin's own manifest rather than re-spelled here, so this harness cannot + * drift from what `auth-plugin.ts` registers at runtime (#14615). + */ +const AUTH_OBJECTS = authIdentityObjects; const engines: ObjectQL[] = []; afterEach(async () => { diff --git a/packages/plugins/plugin-auth/src/credential-at-rest-posture.test.ts b/packages/plugins/plugin-auth/src/credential-at-rest-posture.test.ts index 81465dd3c6..49d3ac4d54 100644 --- a/packages/plugins/plugin-auth/src/credential-at-rest-posture.test.ts +++ b/packages/plugins/plugin-auth/src/credential-at-rest-posture.test.ts @@ -76,35 +76,12 @@ import { createHash, createHmac } from 'node:crypto'; import { ObjectQL } from '@objectstack/objectql'; import { SqlDriver } from '@objectstack/driver-sql'; import { AuthManager } from './auth-manager.js'; +import { authIdentityObjects } from './manifest.js'; import { createTenancyService } from './tenancy-service.js'; import { mintScimConnectionCredential, SCIM_BEARER_PREFIX, } from './scim-connection-service.js'; -import { - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, - SysScimConnectionBinding, - SysScimConnectionCredential, - SysScimGroup, - SysScimGroupMember, - SysScimIdentityTombstone, - SysScimProjectionGrant, - SysScimSubject, - SysScimUser, - SysOauthApplication, - SysOauthAccessToken, - SysOauthRefreshToken, - SysOauthConsent, - SysJwks, -} from '@objectstack/platform-objects'; const BASE = 'http://localhost:3000'; const AUTH = `${BASE}/api/v1/auth`; @@ -146,32 +123,12 @@ afterEach(async () => { } }); -/** The identity surface the org + admin + scim + oauth-provider plugins touch. */ -const AUTH_OBJECTS = [ - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, - // The stable scim model set + the ObjectStack-owned credential store (#3653). - SysScimConnectionBinding, - SysScimConnectionCredential, - SysScimGroup, - SysScimGroupMember, - SysScimIdentityTombstone, - SysScimProjectionGrant, - SysScimSubject, - SysScimUser, - SysOauthApplication, - SysOauthAccessToken, - SysOauthRefreshToken, - SysOauthConsent, - SysJwks, -]; +/** + * The objects a deployment that mounts plugin-auth registers, imported from the + * plugin's own manifest rather than re-spelled here, so this harness cannot + * drift from what `auth-plugin.ts` registers at runtime (#14615). + */ +const AUTH_OBJECTS = authIdentityObjects; async function bootEngine(): Promise { const engine = new ObjectQL(); diff --git a/packages/plugins/plugin-auth/src/dev-admin-seed-credential-gate.test.ts b/packages/plugins/plugin-auth/src/dev-admin-seed-credential-gate.test.ts index 59fdb2d720..22c75968c7 100644 --- a/packages/plugins/plugin-auth/src/dev-admin-seed-credential-gate.test.ts +++ b/packages/plugins/plugin-auth/src/dev-admin-seed-credential-gate.test.ts @@ -55,21 +55,11 @@ import { ObjectQL } from '@objectstack/objectql'; import { SqlDriver } from '@objectstack/driver-sql'; import type { PluginContext } from '@objectstack/core'; import { AuthManager } from './auth-manager.js'; +import { authIdentityObjects } from './manifest.js'; import { AuthPlugin } from './auth-plugin.js'; import { SELF_REGISTRATION_CLOSED } from './audience-posture.js'; import { decideDevAdminSeedGate } from './dev-admin-seed-gate.js'; import { recoverInternalFieldsForSystemRead } from './internal-field-readback.js'; -import { - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, -} from '@objectstack/platform-objects'; const BASE = 'http://localhost:3000'; const AUTH_BASE = '/api/v1/auth'; @@ -78,17 +68,12 @@ const SEED_EMAIL = 'admin@objectos.ai'; const SEED_PASSWORD = 'admin123'; const SYSTEM = { context: { isSystem: true } } as never; -const AUTH_OBJECTS = [ - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, -]; +/** + * The objects a deployment that mounts plugin-auth registers, imported from the + * plugin's own manifest rather than re-spelled here, so this harness cannot + * drift from what `auth-plugin.ts` registers at runtime (#14615). + */ +const AUTH_OBJECTS = authIdentityObjects; /** The env the seed is HARD-gated on (`isDevAdminSeedArmed`). */ const SEED_ENV_KEYS = [ diff --git a/packages/plugins/plugin-auth/src/sso-register-platform-admin-gate.test.ts b/packages/plugins/plugin-auth/src/sso-register-platform-admin-gate.test.ts index 1553b92abe..705d72f000 100644 --- a/packages/plugins/plugin-auth/src/sso-register-platform-admin-gate.test.ts +++ b/packages/plugins/plugin-auth/src/sso-register-platform-admin-gate.test.ts @@ -60,21 +60,10 @@ import { ObjectQL } from '@objectstack/objectql'; import { SqlDriver } from '@objectstack/driver-sql'; import { ADMIN_FULL_ACCESS } from '@objectstack/spec/identity'; import { AuthManager } from './auth-manager.js'; +import { authIdentityObjects } from './manifest.js'; import { AuthPlugin } from './auth-plugin.js'; import { createTenancyService } from './tenancy-service.js'; import type { PluginContext } from '@objectstack/core'; -import { - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, - SysSsoProvider, -} from '@objectstack/platform-objects'; import { inviteForAudienceGate } from './audience-gate-test-support'; const BASE = 'http://localhost:3000'; @@ -82,6 +71,13 @@ const AUTH = `${BASE}/api/v1/auth`; const SECRET = 'test-secret-at-least-32-chars-long-10009'; const SYSTEM = { context: { isSystem: true } } as const; +/** + * The objects a deployment that mounts plugin-auth registers, imported from the + * plugin's own manifest rather than re-spelled here, so this harness cannot + * drift from what `auth-plugin.ts` registers at runtime (#14615). + */ +const AUTH_OBJECTS = authIdentityObjects; + const sysPermissionSet = { name: 'sys_permission_set', label: 'Permission Set', @@ -126,11 +122,7 @@ async function bootEngine(): Promise { true, ); await engine.init(); - const objects = [ - SysUser, SysSession, SysAccount, SysVerification, SysOrganization, - SysMember, SysInvitation, SysTeam, SysTeamMember, SysSsoProvider, - ]; - for (const object of objects) { + for (const object of AUTH_OBJECTS) { engine.registry.registerObject(object as never, '@objectstack/plugin-auth'); } engine.registry.registerObject(sysPermissionSet as never, '@objectstack/plugin-auth'); diff --git a/packages/plugins/plugin-auth/src/walled-owner-operator-stamp.test.ts b/packages/plugins/plugin-auth/src/walled-owner-operator-stamp.test.ts index 728e30a8dc..03e1255ff3 100644 --- a/packages/plugins/plugin-auth/src/walled-owner-operator-stamp.test.ts +++ b/packages/plugins/plugin-auth/src/walled-owner-operator-stamp.test.ts @@ -43,23 +43,13 @@ import { ObjectQL } from '@objectstack/objectql'; import { SqlDriver } from '@objectstack/driver-sql'; import { isEmailVerifiedUserRow } from '@objectstack/types'; import { AuthManager } from './auth-manager.js'; +import { authIdentityObjects } from './manifest.js'; import { isOperatorProvisionedCreation, shouldStampOwnerVerifiedAtCreation, } from './walled-owner-operator-stamp.js'; import { probeWalledOwnerAccountState } from './walled-owner-verification-path.js'; import { inviteForAudienceGate } from './audience-gate-test-support'; -import { - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, -} from '@objectstack/platform-objects'; const BASE = 'http://localhost:3000'; const AUTH = `${BASE}/api/v1/auth`; @@ -110,17 +100,12 @@ const OWNER_LIST = `${OWNER}, ${SECOND_OWNER}`; // ── the real-engine harness (the audience-bootstrap-seam shape) ───────────── -const AUTH_OBJECTS = [ - SysUser, - SysSession, - SysAccount, - SysVerification, - SysOrganization, - SysMember, - SysInvitation, - SysTeam, - SysTeamMember, -]; +/** + * The objects a deployment that mounts plugin-auth registers, imported from the + * plugin's own manifest rather than re-spelled here, so this harness cannot + * drift from what `auth-plugin.ts` registers at runtime (#14615). + */ +const AUTH_OBJECTS = authIdentityObjects; const engines: ObjectQL[] = []; afterEach(async () => {