tests(identity): pin the admin credential clauses and a derived non-admin refusal sweep over the whole /admin/ surface - #9664

Part of #9482.

Deliberately Part of, not Fixes: this pins the clauses that are automatable on this stack and re-scopes the item honestly, but five of the item's clauses are blocked on a product decision (#9652) and one is a screenshot oracle. Closing #9482 on merge would lose that remaining half.

QA run #9401 scored identity-auth.admin-lifecycle-operations green on a pin covering exactly one of its ten clauses (C8, the audit-log shapes).

What lands

admin-route-nonadmin-refusal.dogfood.test.ts — C9's refusal half, over a DERIVED population.

The clause is "the gate holds both ways for EVERY admin operation", and a test that hardcodes today's routes cannot pin that — it passes forever while route N+1 ships unguarded. So the population is read off the running stack:

The item's clause-9 prose names six routes. The real surface is 31.

The derived set and the suite's classification table are checked for exact agreement in both directions: a route the stack serves with no entry fails by name, and an entry the stack no longer serves fails as stale. That is what puts route N+1 in scope automatically — it cannot be added without someone recording what a non-admin must get from it.

The payloads are load-bearing. Measured: better-auth, and the ObjectStack sso / unlock-user / oauth2 mounts, validate the request body before the authorization check. An empty-body /admin/ban-user answers a plain member:

400 {"message":"[body.userId] Invalid input: ...","code":"VALIDATION_ERROR"}

byte-identical to what the platform admin gets. A route-walk built on empty bodies asserts nothing about authorization while looking exactly like a passing security sweep. Every route here is fired with a payload valid enough to reach the gate, and refusals assert code as well as status.

admin-credential-lifecycle.dogfood.test.ts — C1 and C2, both sides.

• create-user with an explicit password alongside generatePassword: true applies the explicit one and returns no generated password — with a generatePassword-only create as the contrast, so the clause cannot be satisfied by generatePassword being inert. The account carries its credential sys_account row.
• set-user-password rotates: the original password is proven to work before the rotation, the new one after, and the old one is refused 401 INVALID_EMAIL_OR_PASSWORD.
• Both refusals are asserted with the state read back: a forged create leaves no row behind; a forged rotation leaves the victim's real password working and the hijack password dead.

What is NOT pinned, and why

#9652 in one line: better-auth's admin plugin authorizes on the legacy user.role === 'admin' scalar, which ADR-0068 D2 deliberately stopped synthesizing — so ban-user, unban-user, set-role, remove-user, impersonate-user, revoke-user-session(s), list-users, get-user, list-user-sessions and update-user refuse the platform admin himself with 403 YOU_ARE_NOT_ALLOWED_TO_*. Measured on the seeded dev admin: sys_user.role is 'user', positions is ['user','platform_admin']. Confirmed by construction — writing role = 'admin' onto that same row flips ban / unban / list-users / impersonate to 200 in the same boot, and the ban then persists and refuses the banned user's sign-in.

Pinning a clause there would require changing an admin route's behaviour, which is not a tests-only call — so it is reported, not done. Neither side of that bucket's allowed half is asserted, so fixing #9652 will not have to edit these tests.

The four /admin/sso/* routes are classified capability-disabled: with SSO off, anonymous, member and admin receive identical capability errors, so authorization is not observable on them here. They carry a tripwire — member and admin must get the same answer — so the day SSO is enabled they go red and get reclassified rather than coasting on a meaningless green (#9653).

Findings filed (unassigned, none fixed here)

• Every better-auth-native /admin/ route refuses ObjectStack platform admins — the vendor gates on the legacy user.role === 'admin' scalar ADR-0068 D2 stopped synthesizing #9652 — the ADR-0068 / better-auth admin-gate mismatch above. Fails closed; a broken admin capability, not an escalation. The console's Ban / Unban / Impersonate buttons are type: 'api' proxies onto those routes, so they inherit it.
• finding: the four /admin/sso/* bridges carry no ObjectStack-side admin gate, and their delegated authorization is unprovable on a stock boot #9653 — finding: the /admin/sso/* bridges carry no ObjectStack-side gate and their delegated gate is unprovable while SSO is off.
• finding: ObjectStack's /admin/ mounts shape-check the request body BEFORE authenticating, so an anonymous caller can probe required-parameter shapes #9654 — finding: validation runs before authentication on the ObjectStack /admin/ mounts, so an anonymous caller can probe required-parameter shapes.

Verification

Suite: vitest run over both new files — Test Files 2 passed (2), Tests 12 passed (12), exit 0.

Measured on the tree of a4362e217. Head is 2a3fb5835, which differs from it by seven // comment lines and nothing else — verified mechanically (every +/- line in git diff a4362e217 2a3fb5835 begins with //), so no executable code changed after the green run.

Ablations. Dogfood resolves @objectstack/plugin-auth through dist/, so each leg rebuilt the package and proved the mutation reached the artifact with scripts/ablation-dist-preflight.mjs before its colour counted.

The first ablation is the one that matters for this card's premise: it demonstrates that a newly mounted /admin/ route is in scope automatically and fails until it is classified.

Local gates, derived from the changed paths with node scripts/pm/dispatch-gates.mjs (not recalled):

check:platform-checklist   OK — 15 areas, 190 items
check:nul-bytes            OK — 6162 files, no raw control bytes
check:cross-package-test-inputs --verify   OK — 12 packages, all declared
check:test-source-alias    OK   check:type-source-resolution  OK
check:query-options-erasure OK — ratchet holds, no files added
check:engine-double-contract OK — 319 pinned    check:where-matcher OK — 255 matchers
check:type-check-coverage  OK    @objectstack/dogfood typecheck  OK
spec: check:empty-state / check:liveness / check:strictness-ledger / check:variant-docs  OK

The two new tests add no filesystem reads, so they are not cross-package escaping tests and need no new declaration — verified by query, with a control proving the search works (0 hits in the new files, 4 in the sibling escaping test). Neither file contains .skip / .only / .todo, also verified with a control.

Two legs deferred, stated rather than implied. check:type-check-debt is NOT MEASURED locally: it refuses without the full workspace closure built, naming @objectstack/service-knowledge as unbuilt, and that refusal means not-measured, never not-applicable. CI runs it with the closure built. And the universal-invariant assertion's own ablation was not run — the shared verify lock stayed contended (queue depth 8-10 for ~25 minutes). Its discrimination is inferred from the gateAdmin ablation, which produced exactly the condition it tests (a plain member receiving 2xx from an /admin/ route) and was caught by the sibling assertion in the same file; it is not directly observed.

CI convergence is the PM's, per the 2026-08-10 ruling.

Changeset

None: the diff is packages/qa/dogfood/test/** (@objectstack/dogfood is private: true) plus the checklist JSON. Nothing publishable changes, and scripts/check-empty-changeset.mjs rejects an empty one — so this carries the skip-changeset label instead.

Generated by Claude Code