fix(plugin-auth,platform-objects): close @better-auth/oauth-provider 1.7 schema drift — restore platform SSO (#3080)

* fix(plugin-auth,platform-objects): close @better-auth/oauth-provider 1.7 schema drift — restore platform SSO

The better-auth 1.7.0-rc.1 bump (4ab16f8 "pnpm upgrade") changed the
oauth-provider model schemas, but the sys_oauth_* platform objects and the
camelCase→snake_case fieldName mappings in auth-schema-config.ts were never
updated. Token exchange then 500s with `table sys_oauth_access_token has no
column named authorizationCodeId`, breaking platform SSO ("Continue with
ObjectStack") end-to-end for every environment login — on SQLite AND
Postgres control planes alike.

- sys_oauth_access_token / sys_oauth_refresh_token: add
  authorization_code_id (indexed), resources, requested_user_info_claims,
  confirmation; access adds revoked; refresh adds rotated_at,
  rotation_replay_response, rotation_replay_expires_at.
- sys_oauth_consent: add resources, requested_user_info_claims.
- sys_oauth_application: add jwks, jwks_uri, backchannel_logout_uri,
  backchannel_logout_session_required, dpop_bound_access_tokens (1.7 DCR
  writes dpopBoundAccessTokens with a default — same crash class).
- New objects for the three models 1.7 introduced: sys_oauth_resource,
  sys_oauth_client_resource (RFC 8707 resource indicators, used by the MCP
  OAuth track), sys_oauth_client_assertion (RFC 7523 jti replay
  prevention); registered in the auth manifest, SystemObjectName, i18n
  extract config, and buildOauthProviderPluginSchema().
- Mappings extended for every camelCase field; regenerated the
  platform-objects translation bundles (additive only).
- NEW oauth-provider-schema-parity.test.ts: iterates the INSTALLED
  plugin's declared schema and fails when any writable column is missing
  from the platform objects — the next better-auth bump that adds fields
  breaks at test time, not in production. (This test is what surfaced the
  three brand-new 1.7 models above.)

Companion changes: cloud registers the ≥1.7 social-flow callback format
(/api/v1/auth/callback/<provider>) alongside the legacy one, and
@object-ui/auth signs OIDC providers in via POST /sign-in/social.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(dogfood): OIDC authorization-code flow e2e — real kernel, real token exchange

Drives authorize → code → token → userinfo against a bootStack kernel with
OS_OIDC_PROVIDER_ENABLED, seeding the client row exactly the way cloud's
seedPlatformSsoClient does (hashed secret, skip_consent, client_secret_basic,
≥1.7 /api/v1/auth/callback/<provider> redirect_uri). The token-exchange step
is the hop that 500'd in production on the 1.7 schema drift; verified the
test fails (2/3) when the authorization_code_id column is removed and passes
(3/3) with the fix. Complements the static parity gate in plugin-auth.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

.changeset/oauth-provider-17-schema-drift.md

@@ -0,0 +1,26 @@
+---
+'@objectstack/platform-objects': minor
+'@objectstack/plugin-auth': patch
+'@objectstack/spec': patch
+---
+
+Close the `@better-auth/oauth-provider` 1.7 schema drift that broke platform
+SSO (token exchange 500: `table sys_oauth_access_token has no column named
+authorizationCodeId`).
+
+- `sys_oauth_access_token` / `sys_oauth_refresh_token`: add
+  `authorization_code_id`, `resources`, `requested_user_info_claims`,
+  `confirmation` (+ access-token `revoked`; + refresh-token `rotated_at`,
+  `rotation_replay_response`, `rotation_replay_expires_at`).
+- `sys_oauth_consent`: add `resources`, `requested_user_info_claims`.
+- `sys_oauth_application`: add `jwks`, `jwks_uri`, `backchannel_logout_uri`,
+  `backchannel_logout_session_required`, `dpop_bound_access_tokens`.
+- New platform objects for the three models 1.7 introduced:
+  `sys_oauth_resource`, `sys_oauth_client_resource`,
+  `sys_oauth_client_assertion` (RFC 8707 resource indicators + RFC 7523
+  client-assertion replay prevention), registered in the auth manifest and
+  mapped in `buildOauthProviderPluginSchema()`.
+- All camelCase→snake_case `fieldName` mappings extended accordingly, and a
+  new parity test (`oauth-provider-schema-parity.test.ts`) fails the build
+  whenever a future better-auth bump introduces model fields our objects or
+  mappings don't cover.

packages/platform-objects/scripts/i18n-extract.config.ts

@@ -47,6 +47,9 @@ import {
   SysOauthAccessToken,
   SysOauthRefreshToken,
   SysOauthConsent,
+  SysOauthResource,
+  SysOauthClientResource,
+  SysOauthClientAssertion,
   SysJwks,
 } from '../src/identity/index.js';
 
@@ -144,6 +147,9 @@ export default defineStack({
     SysOauthAccessToken,
     SysOauthRefreshToken,
     SysOauthConsent,
+    SysOauthResource,
+    SysOauthClientResource,
+    SysOauthClientAssertion,
     SysJwks,
 
     // Security: RBAC moved to @objectstack/plugin-security, sharing to

packages/platform-objects/src/apps/translations/bundle-ownership.test.ts

@@ -22,7 +22,8 @@ const OWNED_OBJECTS = new Set([
   'sys_member', 'sys_invitation', 'sys_team', 'sys_team_member', 'sys_business_unit',
   'sys_business_unit_member', 'sys_api_key', 'sys_two_factor', 'sys_device_code',
   'sys_user_preference', 'sys_oauth_application', 'sys_oauth_access_token',
-  'sys_oauth_refresh_token', 'sys_oauth_consent', 'sys_jwks',
+  'sys_oauth_refresh_token', 'sys_oauth_consent', 'sys_oauth_resource',
+  'sys_oauth_client_resource', 'sys_oauth_client_assertion', 'sys_jwks',
   // audit / messaging-adjacent (still owned here)
   'sys_notification', 'sys_attachment', 'sys_email', 'sys_email_template',
   'sys_saved_report', 'sys_report_schedule', 'sys_job', 'sys_job_run', 'sys_job_queue',

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -1187,6 +1187,18 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "Subject Type",
         help: "OIDC subject type (e.g. public, pairwise)"
       },
+      jwks: {
+        label: "JWKS",
+        help: "Client JSON Web Key Set (for private_key_jwt / signed-request verification)"
+      },
+      jwks_uri: {
+        label: "JWKS URI",
+        help: "URL of the client JSON Web Key Set"
+      },
+      dpop_bound_access_tokens: {
+        label: "DPoP-bound Access Tokens",
+        help: "Require access tokens issued to this client to be DPoP-bound (RFC 9449)"
+      },
       disabled: {
         label: "Disabled"
       },
@@ -1198,6 +1210,14 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "Enable End Session",
         help: "Allow the client to call the OIDC end-session endpoint"
       },
+      backchannel_logout_uri: {
+        label: "Back-channel Logout URI",
+        help: "OIDC back-channel logout endpoint of the client"
+      },
+      backchannel_logout_session_required: {
+        label: "Back-channel Logout Session Required",
+        help: "Whether the back-channel logout token must include a sid claim"
+      },
       software_id: {
         label: "Software ID"
       },
@@ -1312,6 +1332,18 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "Reference ID",
         help: "Caller-supplied correlation identifier"
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "Scopes",
         help: "JSON-serialized list of scopes granted to this token"
@@ -1321,6 +1353,14 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       created_at: {
         label: "Created At"
+      },
+      revoked: {
+        label: "Revoked At",
+        help: "Timestamp at which this access token was revoked"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -1352,6 +1392,18 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "Reference ID",
         help: "Caller-supplied correlation identifier"
       },
+      authorization_code_id: {
+        label: "Authorization Code ID",
+        help: "ID of the authorization-code grant this token chain originates from"
+      },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators bound to this token"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims requested for the userinfo endpoint"
+      },
       scopes: {
         label: "Scopes",
         help: "JSON-serialized list of scopes granted to this token"
@@ -1366,9 +1418,25 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "Revoked At",
         help: "Timestamp at which this refresh token was revoked"
       },
+      rotated_at: {
+        label: "Rotated At",
+        help: "Timestamp at which this token was rotated (superseded by a new row)"
+      },
+      rotation_replay_response: {
+        label: "Rotation Replay Response",
+        help: "Cached token response replayed when the old token is re-presented within the reuse interval"
+      },
+      rotation_replay_expires_at: {
+        label: "Rotation Replay Expires At",
+        help: "End of the post-rotation reuse interval during which the replay response is served"
+      },
       auth_time: {
         label: "Auth Time",
         help: "When the user originally authenticated for this token chain"
+      },
+      confirmation: {
+        label: "Confirmation",
+        help: "JSON RFC 7800 cnf claim (e.g. DPoP key thumbprint) binding this token to a key"
       }
     }
   },
@@ -1392,6 +1460,14 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
         label: "Reference ID",
         help: "Caller-supplied correlation identifier"
       },
+      resources: {
+        label: "Resources",
+        help: "JSON-serialized list of RFC 8707 resource indicators the consent covers"
+      },
+      requested_user_info_claims: {
+        label: "Requested UserInfo Claims",
+        help: "JSON-serialized list of OIDC claims the user consented to expose"
+      },
       scopes: {
         label: "Scopes",
         help: "JSON-serialized list of scopes the user consented to"
@@ -1404,6 +1480,107 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       }
     }
   },
+  sys_oauth_resource: {
+    label: "OAuth Resource",
+    pluralLabel: "OAuth Resources",
+    description: "Registered OAuth protected resources (RFC 8707 resource indicators)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      identifier: {
+        label: "Identifier",
+        help: "Resource indicator URI presented in the RFC 8707 resource parameter"
+      },
+      name: {
+        label: "Name"
+      },
+      access_token_ttl: {
+        label: "Access Token TTL",
+        help: "Access-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      refresh_token_ttl: {
+        label: "Refresh Token TTL",
+        help: "Refresh-token lifetime in seconds for this resource (overrides the server default)"
+      },
+      signing_algorithm: {
+        label: "Signing Algorithm",
+        help: "JWS algorithm used to sign access tokens for this resource"
+      },
+      signing_key_id: {
+        label: "Signing Key ID",
+        help: "Key id (kid) used to sign access tokens for this resource"
+      },
+      allowed_scopes: {
+        label: "Allowed Scopes",
+        help: "JSON-serialized list of scopes clients may request for this resource"
+      },
+      custom_claims: {
+        label: "Custom Claims",
+        help: "JSON object of extra claims stamped on access tokens for this resource"
+      },
+      dpop_bound_access_tokens_required: {
+        label: "DPoP Required",
+        help: "Require access tokens for this resource to be DPoP-bound (RFC 9449)"
+      },
+      disabled: {
+        label: "Disabled"
+      },
+      policy_version: {
+        label: "Policy Version",
+        help: "Monotonic version of the resource token policy"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional resource metadata"
+      },
+      created_at: {
+        label: "Created At"
+      },
+      updated_at: {
+        label: "Updated At"
+      }
+    }
+  },
+  sys_oauth_client_resource: {
+    label: "OAuth Client Resource",
+    pluralLabel: "OAuth Client Resources",
+    description: "Grants allowing an OAuth client to request tokens for a protected resource",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      client_id: {
+        label: "Client ID",
+        help: "Foreign key to sys_oauth_application.client_id"
+      },
+      resource_id: {
+        label: "Resource ID",
+        help: "Foreign key to sys_oauth_resource.identifier"
+      },
+      metadata: {
+        label: "Metadata",
+        help: "JSON object of additional grant metadata"
+      },
+      created_at: {
+        label: "Created At"
+      }
+    }
+  },
+  sys_oauth_client_assertion: {
+    label: "OAuth Client Assertion",
+    pluralLabel: "OAuth Client Assertions",
+    description: "Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)",
+    fields: {
+      id: {
+        label: "ID"
+      },
+      expires_at: {
+        label: "Expires At",
+        help: "Assertion expiry — rows past this instant are safe to prune"
+      }
+    }
+  },
   sys_jwks: {
     label: "JWKS Key",
     pluralLabel: "JWKS Keys",