feat(auth): expose isPlatformAdmin on the customSession user (#1859)

* feat(auth): expose isPlatformAdmin on the customSession user

The session payload already derives an `admin` role when the user is a
platform admin or active-org admin, but it never surfaces the underlying
platform-admin boolean. Console action `visible` CEL predicates need to
distinguish platform-admin-only actions (e.g. sys_environment.change_plan)
from org-admin actions, which a coarse `admin` role cannot do.

Capture the platform-admin check once and attach `isPlatformAdmin` to both
customSession return paths. Org-admins who are not platform admins get
`isPlatformAdmin: false` (correct — those actions are platform-admin-only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(changeset): plugin-auth isPlatformAdmin session field

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

.changeset/adr-adminvis-platform-admin-session.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/plugin-auth": patch
+---
+
+auth: expose `isPlatformAdmin` on the customSession user payload
+
+The session already derives a coarse `admin` role for platform admins or
+active-org admins, but never surfaced the underlying platform-admin signal.
+Console action `visible` CEL predicates need it to gate platform-admin-only
+object actions (e.g. `sys_environment.change_plan`) without hiding org-admin
+actions. Both `customSession` return paths now carry the boolean; org-admins
+who are not platform admins correctly get `isPlatformAdmin: false`.

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -1021,15 +1021,16 @@ export class AuthManager {
           }
         };
 
-        const promote = (await isPlatformAdmin()) || (await isActiveOrgAdmin());
+        const platformAdmin = await isPlatformAdmin();
+        const promote = platformAdmin || (await isActiveOrgAdmin());
         const storedRole = typeof (user as any).role === 'string' ? (user as any).role : '';
         const roles = storedRole
           .split(',')
           .map((s: string) => s.trim())
           .filter(Boolean);
         if (promote && !roles.includes('admin')) roles.push('admin');
-        if (!promote) return { user: { ...user, roles }, session };
-        return { user: { ...user, role: 'admin', roles }, session };
+        if (!promote) return { user: { ...user, roles, isPlatformAdmin: platformAdmin }, session };
+        return { user: { ...user, role: 'admin', roles, isPlatformAdmin: platformAdmin }, session };
       }));
     }