feat(plugin-auth): add bridge route to enable/disable OAuth applications

better-auth 1.6.11's stock admin endpoint /admin/oauth2/update-client
strips `disabled` from its Zod body schema, so the field cannot be
toggled from the HTTP surface even though the column exists and the
runtime honours it everywhere (introspect, token, authorize,
public-client lookup).

Close the gap with a small extension under /api/v1/auth/*:
  POST /api/v1/auth/admin/oauth2/toggle-disabled

The route validates body, requires an admin session (role synthesised
by the customSession plugin), and writes through ObjectQL so the
sys_oauth_application table — better-auth's mapped `oauthClient` —
is updated. All OAuth-application mutations remain auth-routed; no
generic data-layer bypass is exposed.

Wires two sysadmin row actions on sys_oauth_application:
  - enable_oauth_application  (visible when  record.disabled)

When upstream adds `disabled` to adminUpdateOAuthClient's schema,
this bridge can be deleted and the actions retargeted.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: os-zhuang

packages/platform-objects/src/identity/sys-oauth-application.object.ts

@@ -30,20 +30,60 @@ export const SysOauthApplication = ObjectSchema.create({
   compactLayout: ['name', 'client_id', 'type', 'disabled'],
 
   // Custom actions — all OAuth-application mutations are routed through
-  // better-auth's `@better-auth/oauth-provider` endpoints rather than the
-  // generic data layer, so server-side validation, secret hashing, and
-  // audit hooks all run. The generic `delete` API method is intentionally
-  // dropped from `apiMethods` below (see `enable.apiMethods`) so the only
-  // delete path is the better-auth wrapper below.
+  // better-auth's `@better-auth/oauth-provider` endpoints (and a thin
+  // ObjectStack-added auth route for the enable/disable toggle) rather
+  // than the generic data layer, so server-side validation, secret
+  // hashing, and audit hooks all run. The generic `delete` API method
+  // is intentionally dropped from `apiMethods` below so the only delete
+  // path is the better-auth wrapper.
   //
-  // Upstream gap (better-auth 1.6.11): the `/admin/oauth2/update-client`
-  // endpoint does NOT accept the `disabled` flag in its `update` body
-  // schema, and no dedicated enable/disable endpoint exists. Until that
-  // ships upstream, sysadmins cannot toggle `sys_oauth_application.disabled`
-  // through the UI — `delete` is the only kill-switch. See
-  // https://github.com/better-auth/better-auth — track the
-  // `@better-auth/oauth-provider` plugin's adminUpdateOAuthClient schema.
+  // Upstream gap (better-auth 1.6.11): the stock `/admin/oauth2/update-client`
+  // endpoint's Zod body schema does NOT accept the `disabled` flag, even
+  // though the column exists and the runtime honours it. We bridge the
+  // gap with `POST /api/v1/auth/admin/oauth2/toggle-disabled`, registered
+  // by plugin-auth, which writes through better-auth's own adapter under
+  // the auth namespace (no generic data-layer bypass). When upstream
+  // ships `disabled` support, retarget the enable/disable actions and
+  // delete the bridge route.
   actions: [
+    {
+      name: 'disable_oauth_application',
+      label: 'Disable OAuth Application',
+      icon: 'pause-circle',
+      variant: 'secondary',
+      mode: 'custom',
+      locations: ['list_item', 'record_header'],
+      type: 'api',
+      method: 'POST',
+      target: '/api/v1/auth/admin/oauth2/toggle-disabled',
+      confirmText: 'Disable this OAuth application? Active access/refresh tokens issued to it will continue to be rejected at the token, authorize, and introspect endpoints. Existing integrations will stop working immediately.',
+      successMessage: 'OAuth application disabled',
+      refreshAfter: true,
+      visible: '!record.disabled',
+      bodyExtra: { disabled: true },
+      params: [
+        { name: 'client_id', field: 'client_id', defaultFromRow: true, required: true },
+      ],
+    },
+    {
+      name: 'enable_oauth_application',
+      label: 'Enable OAuth Application',
+      icon: 'play-circle',
+      variant: 'primary',
+      mode: 'custom',
+      locations: ['list_item', 'record_header'],
+      type: 'api',
+      method: 'POST',
+      target: '/api/v1/auth/admin/oauth2/toggle-disabled',
+      confirmText: 'Re-enable this OAuth application? Token issuance, authorization, and introspection will resume immediately.',
+      successMessage: 'OAuth application enabled',
+      refreshAfter: true,
+      visible: 'record.disabled',
+      bodyExtra: { disabled: false },
+      params: [
+        { name: 'client_id', field: 'client_id', defaultFromRow: true, required: true },
+      ],
+    },
     {
       name: 'rotate_client_secret',
       label: 'Rotate Client Secret',

packages/platform-objects/src/platform-objects.test.ts

@@ -159,17 +159,43 @@ describe('@objectstack/platform-objects', () => {
 
     it('SysOauthApplication routes all mutations through better-auth, not the data layer', () => {
       const actions = SysOauthApplication.actions ?? [];
+      const names = actions.map((a) => a.name).sort();
+      expect(names).toEqual([
+        'delete_oauth_application',
+        'disable_oauth_application',
+        'enable_oauth_application',
+        'rotate_client_secret',
+      ]);
+
       const rotate = actions.find((a) => a.name === 'rotate_client_secret');
       const del = actions.find((a) => a.name === 'delete_oauth_application');
+      const disable = actions.find((a) => a.name === 'disable_oauth_application');
+      const enable = actions.find((a) => a.name === 'enable_oauth_application');
+
       expect(rotate?.target).toBe('/api/v1/auth/oauth2/client/rotate-secret');
       expect(rotate?.method).toBe('POST');
       expect((rotate?.params ?? []).map((p) => p.field)).toEqual(['client_id']);
+
       expect(del?.target).toBe('/api/v1/auth/oauth2/delete-client');
       expect(del?.method).toBe('POST');
       expect(del?.mode).toBe('delete');
-      // Generic CRUD must NOT expose delete — that path is reserved for
-      // the better-auth-backed action above so OAuth-specific cleanup
-      // (token revocation, consent invalidation) always runs.
+
+      // Enable/disable both hit the ObjectStack-added bridge route on
+      // /api/v1/auth (since better-auth 1.6.11's stock admin endpoint
+      // does not accept `disabled` in its update schema). They differ
+      // only in the static `disabled` body field and the visibility
+      // predicate, so exactly one is active at any time.
+      expect(disable?.target).toBe('/api/v1/auth/admin/oauth2/toggle-disabled');
+      expect(disable?.bodyExtra).toEqual({ disabled: true });
+      expect((disable?.visible as any)?.source).toBe('!record.disabled');
+      expect(enable?.target).toBe('/api/v1/auth/admin/oauth2/toggle-disabled');
+      expect(enable?.bodyExtra).toEqual({ disabled: false });
+      expect((enable?.visible as any)?.source).toBe('record.disabled');
+
+      // Generic CRUD must NOT expose mutating methods — all writes are
+      // reserved for better-auth wrappers above so OAuth-specific
+      // invariants (token revocation on delete, consent invalidation,
+      // disabled checks at runtime) always run.
       expect(SysOauthApplication.enable?.apiMethods).not.toContain('delete');
       expect(SysOauthApplication.enable?.apiMethods).not.toContain('update');
       expect(SysOauthApplication.enable?.apiMethods).not.toContain('create');

packages/plugins/plugin-auth/src/auth-plugin.ts

@@ -433,6 +433,93 @@ export class AuthPlugin implements Plugin {
       }
     });
 
+    // ────────────────────────────────────────────────────────────────────
+    // OAuth admin: toggle the `disabled` flag on a registered OAuth client.
+    //
+    // Why this lives here (and not as a plain data-layer UPDATE on
+    // sys_oauth_application): better-auth 1.6.11's stock admin update
+    // endpoint (`/admin/oauth2/update-client`) does NOT accept `disabled`
+    // in its Zod body schema, so the field gets silently stripped before
+    // it reaches `updateClientEndpoint`. The column exists, the runtime
+    // honours it everywhere (introspect, token, authorize, public-client
+    // lookup), but no client-facing API can flip it.
+    //
+    // We close the gap by writing through better-auth's own adapter under
+    // the `/api/v1/auth/*` namespace so all OAuth-application mutations
+    // remain auth-routed (no generic data-layer bypass for the `oauth_client`
+    // model). When upstream adds `disabled` to `adminUpdateOAuthClient`'s
+    // schema, this route can be deleted and the sys_oauth_application
+    // action retargeted to the stock endpoint.
+    //
+    // Upstream tracking: https://github.com/better-auth/better-auth
+    rawApp.post(`${basePath}/admin/oauth2/toggle-disabled`, async (c: any) => {
+      try {
+        let body: any = {};
+        try { body = await c.req.json(); } catch { body = {}; }
+        const clientId: unknown = body?.client_id;
+        const disabled: unknown = body?.disabled;
+        if (typeof clientId !== 'string' || clientId.length === 0) {
+          return c.json({ success: false, error: { code: 'invalid_request', message: 'client_id is required' } }, 400);
+        }
+        if (typeof disabled !== 'boolean') {
+          return c.json({ success: false, error: { code: 'invalid_request', message: 'disabled must be a boolean' } }, 400);
+        }
+
+        const authApi = await this.authManager!.getApi();
+        const session = await authApi.getSession({ headers: c.req.raw.headers });
+        if (!session?.user?.id) {
+          return c.json({ success: false, error: { code: 'unauthorized', message: 'Sign in first' } }, 401);
+        }
+        // The customSession plugin synthesizes `user.role = 'admin'` for
+        // platform admins (admin_full_access permission set) and active-org
+        // owners/admins; anyone else is denied.
+        if ((session.user as any).role !== 'admin') {
+          return c.json({ success: false, error: { code: 'forbidden', message: 'Admin role required' } }, 403);
+        }
+
+        // Write through the same ObjectQL data engine that better-auth's
+        // adapter uses. We target the snake_case table name (`sys_oauth_application`,
+        // mapped from better-auth's internal `oauthClient` model via
+        // `auth-schema-config.ts`) because `$context.adapter`'s model-lookup
+        // helper does not see plugin-provided model names from outside
+        // better-auth's own endpoint invocation context. This is the same
+        // physical row the better-auth runtime reads at introspect / token
+        // / authorize time, so the toggle is fully honoured.
+        const dataEngine: any = this.authManager!.getDataEngine();
+        if (!dataEngine) {
+          return c.json({ success: false, error: { code: 'unavailable', message: 'Data engine unavailable' } }, 503);
+        }
+
+        const existing = await dataEngine.findOne('sys_oauth_application', {
+          where: { client_id: clientId },
+        });
+        if (!existing) {
+          return c.json({ success: false, error: { code: 'not_found', message: 'OAuth client not found' } }, 404);
+        }
+
+        const updated = await dataEngine.update('sys_oauth_application', {
+          id: existing.id,
+          disabled,
+          updated_at: new Date(Math.floor(Date.now() / 1000) * 1000),
+        });
+        if (!updated) {
+          return c.json({ success: false, error: { code: 'internal', message: 'Unable to update OAuth client' } }, 500);
+        }
+
+        return c.json({
+          success: true,
+          data: {
+            client_id: clientId,
+            disabled,
+          },
+        });
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error('[AuthPlugin] toggle-disabled failed', err);
+        return c.json({ success: false, error: { code: 'internal', message: err.message } }, 500);
+      }
+    });
+
     // Register wildcard route to forward all auth requests to better-auth.
     // better-auth is configured with basePath matching our route prefix, so we
     // forward the original request directly — no path rewriting needed.