feat(auth): expose isPlatformAdmin on the customSession user

.changeset/adr-adminvis-platform-admin-session.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/plugin-auth": patch
+---
+
+auth: expose `isPlatformAdmin` on the customSession user payload
+
+The session already derives a coarse `admin` role for platform admins or
+active-org admins, but never surfaced the underlying platform-admin signal.
+Console action `visible` CEL predicates need it to gate platform-admin-only
+object actions (e.g. `sys_environment.change_plan`) without hiding org-admin
+actions. Both `customSession` return paths now carry the boolean; org-admins
+who are not platform admins correctly get `isPlatformAdmin: false`.

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -1021,15 +1021,16 @@ export class AuthManager {
           }
         };
 
-        const promote = (await isPlatformAdmin()) || (await isActiveOrgAdmin());
+        const platformAdmin = await isPlatformAdmin();
+        const promote = platformAdmin || (await isActiveOrgAdmin());
         const storedRole = typeof (user as any).role === 'string' ? (user as any).role : '';
         const roles = storedRole
           .split(',')
           .map((s: string) => s.trim())
           .filter(Boolean);
         if (promote && !roles.includes('admin')) roles.push('admin');
-        if (!promote) return { user: { ...user, roles }, session };
-        return { user: { ...user, role: 'admin', roles }, session };
+        if (!promote) return { user: { ...user, roles, isPlatformAdmin: platformAdmin }, session };
+        return { user: { ...user, role: 'admin', roles, isPlatformAdmin: platformAdmin }, session };
       }));
     }