feat(auth): bridge schema-less plugin models in the factory adapter (sso)

Make createObjectQLAdapterFactory resolve the table name (resolveProtocolName)
AND map camelCase<->snake fields for models remapped via AUTH_MODEL_TO_PROTOCOL
— i.e. better-auth plugins like @better-auth/sso that expose no `schema` option.
Scoped by `objectName !== model`, so core / schema-declared models are
byte-for-byte unchanged.

This makes the @better-auth/sso integration (sys_sso_provider) functional at the
data layer.

Verified: 29 unit tests pass — 3 new sso-bridging tests drive the REAL
better-auth adapter wrapper (sso plugin loaded): insert maps ssoProvider +
oidcConfig -> sys_sso_provider + oidc_config, reads map back to camelCase, where
fields are snaked; the 26 existing core-path tests are unchanged.

Remaining: full browser E2E (login via a live external OIDC IdP -> JIT user +
sys_account.provider_id + default role).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/plugins/plugin-auth/src/objectql-adapter.test.ts

@@ -24,6 +24,7 @@ import {
 } from './auth-schema-config';
 import { SystemObjectName } from '@objectstack/spec/system';
 import type { IDataEngine } from '@objectstack/core';
+import { sso } from '@better-auth/sso';
 
 describe('AUTH_MODEL_TO_PROTOCOL mapping', () => {
   it('should map all four core better-auth models to sys_ protocol names', () => {
@@ -279,3 +280,46 @@ describe('createObjectQLAdapter – legacy model name mapping', () => {
     expect(mockEngine.insert).toHaveBeenCalledWith('organization', { name: 'Acme' });
   });
 });
+
+describe('createObjectQLAdapterFactory – schema-less plugin bridging (@better-auth/sso)', () => {
+  // The sso plugin exposes no `schema` option, so its `ssoProvider` table +
+  // camelCase fields are bridged at the adapter layer. Pass the plugin so
+  // better-auth's wrapper recognises the model (it validates against the
+  // merged schema before delegating to our adapter methods).
+  const makeAdapter = (findOneRow: any = { id: '1', provider_id: 'okta', oidc_config: '{"clientId":"x"}', domain: 'acme.com' }) => {
+    const engine = {
+      insert: vi.fn().mockImplementation((_m: string, d: any) => Promise.resolve({ id: '1', ...d })),
+      findOne: vi.fn().mockResolvedValue(findOneRow),
+      find: vi.fn().mockResolvedValue([]),
+      count: vi.fn().mockResolvedValue(0),
+      update: vi.fn().mockResolvedValue({ id: '1' }),
+      delete: vi.fn().mockResolvedValue(undefined),
+    } as unknown as IDataEngine;
+    const adapter: any = (createObjectQLAdapterFactory(engine) as any)({ plugins: [sso()] } as any);
+    return { engine, adapter };
+  };
+
+  it('resolveProtocolName bridges ssoProvider -> sys_sso_provider', () => {
+    expect(resolveProtocolName('ssoProvider')).toBe('sys_sso_provider');
+    expect(AUTH_MODEL_TO_PROTOCOL.ssoProvider).toBe('sys_sso_provider');
+  });
+
+  it('maps the ssoProvider model + camelCase fields to sys_sso_provider snake columns on insert', async () => {
+    const { engine, adapter } = makeAdapter();
+    await adapter.create({ model: 'ssoProvider', data: { providerId: 'okta', oidcConfig: '{"clientId":"x"}', domain: 'acme.com' } });
+    const [tbl, payload] = (engine.insert as any).mock.calls[0];
+    expect(tbl).toBe('sys_sso_provider');
+    expect(payload).toMatchObject({ provider_id: 'okta', oidc_config: '{"clientId":"x"}', domain: 'acme.com' });
+    expect(payload).not.toHaveProperty('oidcConfig');
+  });
+
+  it('maps snake columns back to camelCase on read', async () => {
+    const { adapter } = makeAdapter();
+    const row: any = await adapter.findOne({
+      model: 'ssoProvider',
+      where: [{ field: 'providerId', value: 'okta', operator: 'eq', connector: 'AND' }],
+    });
+    expect(row).toMatchObject({ providerId: 'okta', oidcConfig: '{"clientId":"x"}' });
+    expect(row).not.toHaveProperty('oidc_config');
+  });
+});

packages/plugins/plugin-auth/src/objectql-adapter.ts

@@ -161,6 +161,21 @@ function convertWhere(where: CleanedWhere[]): Record<string, any> {
  * @returns better-auth AdapterFactory
  */
 export function createObjectQLAdapterFactory(dataEngine: IDataEngine) {
+  // Field-name bridging for better-auth plugins that expose NO `schema` option
+  // (e.g. @better-auth/sso): when a model is remapped via AUTH_MODEL_TO_PROTOCOL,
+  // its camelCase model fields are also converted to snake_case columns on the
+  // way in and back to camelCase on the way out. SCOPED by `objectName !== model`
+  // so core / schema-declared models are byte-for-byte untouched.
+  const camelToSnake = (s: string): string => s.replace(/[A-Z]/g, (c) => '_' + c.toLowerCase());
+  const snakeToCamel = (s: string): string => s.replace(/_([a-z])/g, (_m, c) => c.toUpperCase());
+  const remapKeys = (obj: Record<string, any>, fn: (k: string) => string): Record<string, any> => {
+    const out: Record<string, any> = {};
+    for (const k of Object.keys(obj)) out[fn(k)] = obj[k];
+    return out;
+  };
+  const remapWhere = (where: CleanedWhere[]): CleanedWhere[] =>
+    where.map((c) => ({ ...c, field: camelToSnake(c.field) }));
+
   return createAdapterFactory({
     config: {
       adapterId: 'objectql',
@@ -177,18 +192,25 @@ export function createObjectQLAdapterFactory(dataEngine: IDataEngine) {
       create: async <T extends Record<string, any>>(
         { model, data, select: _select }: { model: string; data: T; select?: string[] },
       ): Promise<T> => {
-        const result = await dataEngine.insert(model, data);
-        return normaliseLegacyDates(model, result) as T;
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const result = await dataEngine.insert(objectName, bridged ? remapKeys(data, camelToSnake) : data);
+        const norm = normaliseLegacyDates(model, result);
+        return (bridged ? remapKeys(norm, snakeToCamel) : norm) as T;
       },
 
       findOne: async <T>(
         { model, where, select, join: _join }: { model: string; where: CleanedWhere[]; select?: string[]; join?: any },
       ): Promise<T | null> => {
-        const filter = convertWhere(where);
-
-        const result = await dataEngine.findOne(model, { where: filter, fields: select });
-
-        return result ? (normaliseLegacyDates(model, result) as T) : null;
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const fields = bridged && select ? select.map(camelToSnake) : select;
+
+        const result = await dataEngine.findOne(objectName, { where: filter, fields });
+        if (!result) return null;
+        const norm = normaliseLegacyDates(model, result);
+        return (bridged ? remapKeys(norm, snakeToCamel) : norm) as T;
       },
 
       findMany: async <T>(
@@ -197,74 +219,93 @@ export function createObjectQLAdapterFactory(dataEngine: IDataEngine) {
           offset?: number; sortBy?: { field: string; direction: 'asc' | 'desc' }; join?: any;
         },
       ): Promise<T[]> => {
-        const filter = where ? convertWhere(where) : {};
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = where ? convertWhere(bridged ? remapWhere(where) : where) : {};
 
         const orderBy = sortBy
-          ? [{ field: sortBy.field, order: sortBy.direction as 'asc' | 'desc' }]
+          ? [{ field: bridged ? camelToSnake(sortBy.field) : sortBy.field, order: sortBy.direction as 'asc' | 'desc' }]
           : undefined;
 
-        const results = await dataEngine.find(model, {
+        const results = await dataEngine.find(objectName, {
           where: filter,
           limit: limit || 100,
           offset,
           orderBy,
         });
 
-        return results.map((r) => normaliseLegacyDates(model, r as Record<string, any>)) as T[];
+        return results.map((r) => {
+          const norm = normaliseLegacyDates(model, r as Record<string, any>);
+          return bridged ? remapKeys(norm, snakeToCamel) : norm;
+        }) as T[];
       },
 
       count: async (
         { model, where }: { model: string; where?: CleanedWhere[] },
       ): Promise<number> => {
-        const filter = where ? convertWhere(where) : {};
-        return await dataEngine.count(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = where ? convertWhere(bridged ? remapWhere(where) : where) : {};
+        return await dataEngine.count(objectName, { where: filter });
       },
 
       update: async <T>(
         { model, where, update }: { model: string; where: CleanedWhere[]; update: T },
       ): Promise<T | null> => {
-        const filter = convertWhere(where);
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
 
         // ObjectQL requires an ID for updates – find the record first
-        const record = await dataEngine.findOne(model, { where: filter });
+        const record = await dataEngine.findOne(objectName, { where: filter });
         if (!record) return null;
 
-        const result = await dataEngine.update(model, { ...(update as any), id: record.id });
-        return result ? (normaliseLegacyDates(model, result) as T) : null;
+        const patch = bridged ? remapKeys(update as any, camelToSnake) : (update as any);
+        const result = await dataEngine.update(objectName, { ...patch, id: record.id });
+        if (!result) return null;
+        const norm = normaliseLegacyDates(model, result);
+        return (bridged ? remapKeys(norm, snakeToCamel) : norm) as T;
       },
 
       updateMany: async (
         { model, where, update }: { model: string; where: CleanedWhere[]; update: Record<string, any> },
       ): Promise<number> => {
-        const filter = convertWhere(where);
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
 
         // Sequential updates: ObjectQL requires an ID per update
-        const records = await dataEngine.find(model, { where: filter });
+        const records = await dataEngine.find(objectName, { where: filter });
+        const patch = bridged ? remapKeys(update, camelToSnake) : update;
         for (const record of records) {
-          await dataEngine.update(model, { ...update, id: record.id });
+          await dataEngine.update(objectName, { ...patch, id: record.id });
         }
         return records.length;
       },
 
       delete: async (
         { model, where }: { model: string; where: CleanedWhere[] },
       ): Promise<void> => {
-        const filter = convertWhere(where);
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
 
-        const record = await dataEngine.findOne(model, { where: filter });
+        const record = await dataEngine.findOne(objectName, { where: filter });
         if (!record) return;
 
-        await dataEngine.delete(model, { where: { id: record.id } });
+        await dataEngine.delete(objectName, { where: { id: record.id } });
       },
 
       deleteMany: async (
         { model, where }: { model: string; where: CleanedWhere[] },
       ): Promise<number> => {
-        const filter = convertWhere(where);
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
 
-        const records = await dataEngine.find(model, { where: filter });
+        const records = await dataEngine.find(objectName, { where: filter });
         for (const record of records) {
-          await dataEngine.delete(model, { where: { id: record.id } });
+          await dataEngine.delete(objectName, { where: { id: record.id } });
         }
         return records.length;
       },