fix(security): platform admins see all rows of better-auth-managed identity objects (ADR-0024 / cloud#551)

[os-zhuang]

Why

managedBy: 'better-auth' identity tables (sys_oauth_application, sys_account, sys_session, sys_sso_provider, …) are written by better-auth's own adapter with no tenant context, so organization_id is never stamped and member_default's wildcard tenant_isolation RLS denies every row — a platform admin's Setup lists (OAuth Applications, Identity Links, …) render empty. (This is the systemic root of the sys_sso_provider list-empty issue I patched per-object earlier.)

What

Extend the posture-gated superuser bypass (today: private / tenancy.enabled:false) to managedBy:'better-auth' objects, so a platform admin's viewAllRecords sees all identity rows env-wide.

Admin-only, no member leak:

• Members never trigger the bypass → their _self carve-outs / tenant_isolation still apply (regression test asserts a member stays tenant-scoped).
• The new flag is deliberately not used in the wildcard-policy drop, so it can't expose rows to non-admins.
• Only the platform super-admin (admin_full_accessviewAllRecords) is affected; org-admins (no '*' viewAllRecords) are not.

This fixes the whole class without per-object tenancy changes — important because some of these objects (sys_oauth_application) are cross-env-isolated in the control plane, so a global tenancy flag would be unsafe; the admin-bypass is.

Verification

• 145 security-plugin tests green (incl. 2 new: admin bypassed / member tenant-scoped).
• Browser E2E: a platform admin sees allsys_session rows (own + another user's); a plain member sees only their own.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jun 27, 2026 7:21pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security.

8 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/implementation-status.mdx(via @objectstack/plugin-security)
• content/docs/concepts/packages.mdx(via @objectstack/plugin-security)
• content/docs/getting-started/cli.mdx(via @objectstack/plugin-security)
• content/docs/guides/cheatsheets/permissions-matrix.mdx(via packages/plugins/plugin-security)
• content/docs/guides/metadata/dashboard.mdx(via @objectstack/plugin-security)
• content/docs/guides/packages.mdx(via @objectstack/plugin-security)
• content/docs/guides/plugins.mdx(via @objectstack/plugin-security)
• content/docs/guides/security.mdx(via @objectstack/plugin-security)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.