Closes #3325. Follow-through of #3220 / ADR-0103 (merged in #3315).

Problem

The default permission sets deny generic writes on better-auth identity tables via a hand-maintained BETTER_AUTH_MANAGED_OBJECTS list — the drift ADR-0092 forbids, and it had already drifted: 17 listed vs 22 schemas declaring managedBy: 'better-auth', leaving sys_scim_provider, sys_sso_provider, sys_oauth_resource, sys_oauth_client_resource, sys_oauth_client_assertion wildcard-granted for writes at the permission-evaluator layer. Not exploitable (plugin-auth's identity write guard still 403s the write), but a defense-in-depth gap + an ADR-0049 unenforced-property.

Approach

Derive the deny-list from the live registry so the permission layer can't disagree with the schemas. Two facts shaped it (both pinned by tests):

1. A DB-row-only fix would be dead code — the evaluator resolves the default sets from the in-memory bootstrapPermissionSets, not the seeded DB JSON. The transform mutates those shared PermissionSet instances in place at kernel:ready, before the seeder, so every consumer (evaluator, manifest.register, seed row) sees it atomically.
2. sys_user is an intentional divergence — it declares userActions: { edit: true } (a field-level whitelist the identity guard enforces), so the deny must key off the raw better-auth bucket and hard-deny writes, not derive from resolveCrudAffordances (which would widen sys_user edit).

Changes

• New internal applyManagedWriteDenies (managed-object-write-denies.ts): injects a read-only-write deny for every registered managedBy: 'better-auth' object into the four write-granting sets (organization_admin, member_default, viewer_readonly, MCP write). Never touches admin_full_access, never overrides an existing entry, idempotent.
• Wired into security-plugin.ts runBootstrap (once-flag, before bootstrapPlatformAdmin), reading the registry via the existing readDeclared(ql, 'object').
• Static BETTER_AUTH_MANAGED_OBJECTS completed to 22 and kept as a compile-time baseline (covers the pre-kernel:ready window), now pinned bidirectionally against the @objectstack/platform-objects schemas.

Explicitly out of scope

Engine-owned system/append-only objects are not given deny entries — a per-object entry overrides the wildcard and would drop viewAllRecords; their writes are already rejected by the ADR-0103 engine guard (assertEngineOwnedWriteAllowed) and reflected in the /me/permissions clamp. Documented in the module header.

Verification

@objectstack/plugin-security — 539 passed (was 521; +18), build/DTS typecheck clean. New/extended tests: helper behavior, the drift pin (fails on the old 17-name list — proof it bites), seed-row serialization + resync, and a reference-sharing integration pin (a registry-only better-auth object lands on the shared default set).

Accepted side effects (byte-preserving for the 17 already-listed tables)

• organization_admin loses wildcard viewAllRecords/modifyAllRecords on the 5 newly-denied objects — identical posture to the existing 17 (allowRead retained).
• Writes to the 5 tables under member_default now fail at the evaluator instead of the engine guard — same outcome, different error origin.

Related

#3220 · #3315 · ADR-0092 (registry-driven, no hardcoded lists) · ADR-0103 · ADR-0049

🤖 Generated with Claude Code

Generated by Claude Code