test(plugin-auth): import the registered object set from the manifest in five harnesses

packages/plugins/plugin-auth/src/audience-bootstrap-seam.test.ts

@@ -61,35 +61,20 @@ import { describe, it, expect, afterEach } from 'vitest';
 import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { AuthManager } from './auth-manager.js';
+import { authIdentityObjects } from './manifest.js';
 import { SELF_REGISTRATION_CLOSED, isHumanUserRow } from './audience-posture.js';
-import {
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-} from '@objectstack/platform-objects';
 
 const BASE = 'http://localhost:3000';
 const AUTH = `${BASE}/api/v1/auth`;
 const SECRET = 'test-secret-at-least-32-chars-long-11767';
 const PASSWORD = 'S3cure!Passw0rd-11767';
 
-const AUTH_OBJECTS = [
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-];
+/**
+ * The objects a deployment that mounts plugin-auth registers, imported from the
+ * plugin's own manifest rather than re-spelled here, so this harness cannot
+ * drift from what `auth-plugin.ts` registers at runtime (#14615).
+ */
+const AUTH_OBJECTS = authIdentityObjects;
 
 const engines: ObjectQL[] = [];
 afterEach(async () => {

packages/plugins/plugin-auth/src/credential-at-rest-posture.test.ts

@@ -76,35 +76,12 @@ import { createHash, createHmac } from 'node:crypto';
 import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { AuthManager } from './auth-manager.js';
+import { authIdentityObjects } from './manifest.js';
 import { createTenancyService } from './tenancy-service.js';
 import {
   mintScimConnectionCredential,
   SCIM_BEARER_PREFIX,
 } from './scim-connection-service.js';
-import {
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-  SysScimConnectionBinding,
-  SysScimConnectionCredential,
-  SysScimGroup,
-  SysScimGroupMember,
-  SysScimIdentityTombstone,
-  SysScimProjectionGrant,
-  SysScimSubject,
-  SysScimUser,
-  SysOauthApplication,
-  SysOauthAccessToken,
-  SysOauthRefreshToken,
-  SysOauthConsent,
-  SysJwks,
-} from '@objectstack/platform-objects';
 
 const BASE = 'http://localhost:3000';
 const AUTH = `${BASE}/api/v1/auth`;
@@ -146,32 +123,12 @@ afterEach(async () => {
   }
 });
 
-/** The identity surface the org + admin + scim + oauth-provider plugins touch. */
-const AUTH_OBJECTS = [
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-  // The stable scim model set + the ObjectStack-owned credential store (#3653).
-  SysScimConnectionBinding,
-  SysScimConnectionCredential,
-  SysScimGroup,
-  SysScimGroupMember,
-  SysScimIdentityTombstone,
-  SysScimProjectionGrant,
-  SysScimSubject,
-  SysScimUser,
-  SysOauthApplication,
-  SysOauthAccessToken,
-  SysOauthRefreshToken,
-  SysOauthConsent,
-  SysJwks,
-];
+/**
+ * The objects a deployment that mounts plugin-auth registers, imported from the
+ * plugin's own manifest rather than re-spelled here, so this harness cannot
+ * drift from what `auth-plugin.ts` registers at runtime (#14615).
+ */
+const AUTH_OBJECTS = authIdentityObjects;
 
 async function bootEngine(): Promise<ObjectQL> {
   const engine = new ObjectQL();

packages/plugins/plugin-auth/src/dev-admin-seed-credential-gate.test.ts

@@ -55,21 +55,11 @@ import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import type { PluginContext } from '@objectstack/core';
 import { AuthManager } from './auth-manager.js';
+import { authIdentityObjects } from './manifest.js';
 import { AuthPlugin } from './auth-plugin.js';
 import { SELF_REGISTRATION_CLOSED } from './audience-posture.js';
 import { decideDevAdminSeedGate } from './dev-admin-seed-gate.js';
 import { recoverInternalFieldsForSystemRead } from './internal-field-readback.js';
-import {
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-} from '@objectstack/platform-objects';
 
 const BASE = 'http://localhost:3000';
 const AUTH_BASE = '/api/v1/auth';
@@ -78,17 +68,12 @@ const SEED_EMAIL = 'admin@objectos.ai';
 const SEED_PASSWORD = 'admin123';
 const SYSTEM = { context: { isSystem: true } } as never;
 
-const AUTH_OBJECTS = [
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-];
+/**
+ * The objects a deployment that mounts plugin-auth registers, imported from the
+ * plugin's own manifest rather than re-spelled here, so this harness cannot
+ * drift from what `auth-plugin.ts` registers at runtime (#14615).
+ */
+const AUTH_OBJECTS = authIdentityObjects;
 
 /** The env the seed is HARD-gated on (`isDevAdminSeedArmed`). */
 const SEED_ENV_KEYS = [

packages/plugins/plugin-auth/src/sso-register-platform-admin-gate.test.ts

@@ -60,28 +60,24 @@ import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { ADMIN_FULL_ACCESS } from '@objectstack/spec/identity';
 import { AuthManager } from './auth-manager.js';
+import { authIdentityObjects } from './manifest.js';
 import { AuthPlugin } from './auth-plugin.js';
 import { createTenancyService } from './tenancy-service.js';
 import type { PluginContext } from '@objectstack/core';
-import {
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-  SysSsoProvider,
-} from '@objectstack/platform-objects';
 import { inviteForAudienceGate } from './audience-gate-test-support';
 
 const BASE = 'http://localhost:3000';
 const AUTH = `${BASE}/api/v1/auth`;
 const SECRET = 'test-secret-at-least-32-chars-long-10009';
 const SYSTEM = { context: { isSystem: true } } as const;
 
+/**
+ * The objects a deployment that mounts plugin-auth registers, imported from the
+ * plugin's own manifest rather than re-spelled here, so this harness cannot
+ * drift from what `auth-plugin.ts` registers at runtime (#14615).
+ */
+const AUTH_OBJECTS = authIdentityObjects;
+
 const sysPermissionSet = {
   name: 'sys_permission_set',
   label: 'Permission Set',
@@ -126,11 +122,7 @@ async function bootEngine(): Promise<ObjectQL> {
     true,
   );
   await engine.init();
-  const objects = [
-    SysUser, SysSession, SysAccount, SysVerification, SysOrganization,
-    SysMember, SysInvitation, SysTeam, SysTeamMember, SysSsoProvider,
-  ];
-  for (const object of objects) {
+  for (const object of AUTH_OBJECTS) {
     engine.registry.registerObject(object as never, '@objectstack/plugin-auth');
   }
   engine.registry.registerObject(sysPermissionSet as never, '@objectstack/plugin-auth');

packages/plugins/plugin-auth/src/walled-owner-operator-stamp.test.ts

@@ -43,23 +43,13 @@ import { ObjectQL } from '@objectstack/objectql';
 import { SqlDriver } from '@objectstack/driver-sql';
 import { isEmailVerifiedUserRow } from '@objectstack/types';
 import { AuthManager } from './auth-manager.js';
+import { authIdentityObjects } from './manifest.js';
 import {
   isOperatorProvisionedCreation,
   shouldStampOwnerVerifiedAtCreation,
 } from './walled-owner-operator-stamp.js';
 import { probeWalledOwnerAccountState } from './walled-owner-verification-path.js';
 import { inviteForAudienceGate } from './audience-gate-test-support';
-import {
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-} from '@objectstack/platform-objects';
 
 const BASE = 'http://localhost:3000';
 const AUTH = `${BASE}/api/v1/auth`;
@@ -110,17 +100,12 @@ const OWNER_LIST = `${OWNER}, ${SECOND_OWNER}`;
 
 // ── the real-engine harness (the audience-bootstrap-seam shape) ─────────────
 
-const AUTH_OBJECTS = [
-  SysUser,
-  SysSession,
-  SysAccount,
-  SysVerification,
-  SysOrganization,
-  SysMember,
-  SysInvitation,
-  SysTeam,
-  SysTeamMember,
-];
+/**
+ * The objects a deployment that mounts plugin-auth registers, imported from the
+ * plugin's own manifest rather than re-spelled here, so this harness cannot
+ * drift from what `auth-plugin.ts` registers at runtime (#14615).
+ */
+const AUTH_OBJECTS = authIdentityObjects;
 
 const engines: ObjectQL[] = [];
 afterEach(async () => {