fix(auth): restore admin gate on OAuth toggle-disabled after ADR-0068

[baozhoutao]

What

ADR-0068 (a3a5abff8) stopped the server customSession from synthesizing user.role = 'admin'. Canonical roles now arrive in user.roles[] (platform_admin / org_*) with user.isPlatformAdmin as a derived alias.

The OAuth-client enable/disable route — POST {basePath}/admin/oauth-application/toggle-disabled in auth-plugin.ts — was missed in that migration and still gated on:

if ((session.user as any).role !== 'admin') { /* 403 */ }

Since user.role is no longer synthesized, this now rejects even platform admins (unless the admin-plugin literally stored the 'admin' scalar on their row). The sibling /admin/unlock-user route in the same file was migrated correctly; this one was not.

Fix

Gate on the same three canonical signals as /admin/unlock-user:

const u: any = session.user;
const isAdmin =
  u?.isPlatformAdmin === true ||
  (Array.isArray(u?.roles) && u.roles.includes('platform_admin')) ||
  u?.role === 'admin';

Also corrects the stale customSession() doc comment in auth-manager.ts that still described the removed user.role = 'admin' overwrite (the very pattern downstream consumers copied).

⚠️ Behavior / posture note for reviewers

The pre-ADR-0068 role === 'admin' check implicitly allowed active-org owners/admins too (they were synthesized to role='admin'), as the old comment stated. This fix makes the gate platform-admin-only, matching the sibling unlock-user route and treating OAuth-client management as an instance-level concern. If org owners/admins are intended to manage OAuth clients, add org_owner/org_admin to the roles[] check — flagging explicitly so this is a conscious decision rather than a silent change.

Verification

• @objectstack/plugin-auth build + DTS type-check clean.
• Changeset included (patch).

Companion

objectui #2063 fixes the same missed migration on the client (4 views gating on user?.role === 'admin').

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jun 29, 2026 3:02am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth.

10 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/implementation-status.mdx (via @objectstack/plugin-auth)
• content/docs/concepts/packages.mdx (via @objectstack/plugin-auth)
• content/docs/getting-started/cli.mdx (via @objectstack/plugin-auth)
• content/docs/guides/auth-sso.mdx (via @objectstack/plugin-auth)
• content/docs/guides/authentication.mdx (via @objectstack/plugin-auth)
• content/docs/guides/kernel-services.mdx (via @objectstack/plugin-auth)
• content/docs/guides/packages.mdx (via @objectstack/plugin-auth)
• content/docs/guides/plugins.mdx (via @objectstack/plugin-auth)
• content/docs/guides/production-readiness.mdx (via @objectstack/plugin-auth)
• content/docs/releases/v9.mdx (via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.