@opensaas/stack-auth 0.39.2 → 0.41.0

package/tests/mcp-oauth-cascade-e2e.test.ts

@@ -0,0 +1,267 @@
+import { describe, it, expect } from 'vitest'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { existsSync } from 'node:fs'
+import fsp from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { createAuth } from '../src/server/index.js'
+import type { OpenSaasConfig, AccessContext } from '@opensaas/stack-core'
+
+/**
+ * Live end-to-end proof that consolidating the plugin-table derivation onto
+ * `deriveAuthLists` (issue #992) actually closes the orphaned-row defect
+ * #992's own triage confirmed: generates a real Prisma schema (MCP plugin
+ * enabled, so the OAuth tables are derived with real foreign keys), pushes
+ * it to a real SQLite database, signs up a real user through a real
+ * `betterAuth()` instance (via `createAuth()`, the package's own source, not
+ * a stale build), attaches OAuth rows to that user via the raw Prisma client
+ * (the same path better-auth's own adapter writes through — these lists ship
+ * closed per ADR-0013), deletes the user through better-auth's own
+ * `/delete-user` endpoint (the exact `internalAdapter.deleteUser` path
+ * #992's triage traced), and asserts the database cascade removed every
+ * OAuth row rather than leaving them orphaned.
+ *
+ * Follows the same opt-in/offline-toolchain pattern as `rate-limit-e2e.test.ts`
+ * (see ADR-0002) — kept out of the fast unit lane, run only in the `e2e` CI
+ * job where `pnpm install && pnpm build` have already run.
+ */
+
+const run = promisify(execFile)
+const here = path.dirname(new URL(import.meta.url).pathname)
+const repoRoot = path.resolve(here, '../../..')
+
+const opensaasCli = path.join(repoRoot, 'packages/cli/dist/index.js')
+const coreDist = path.join(repoRoot, 'packages/core/dist')
+const authDist = path.join(repoRoot, 'packages/auth/dist')
+const toolchainNodeModules = path.join(repoRoot, 'examples/starter-auth/node_modules')
+
+const guardEnabled = process.env.RUN_MCP_OAUTH_CASCADE_E2E === '1'
+
+const prerequisitesPresent =
+  guardEnabled &&
+  existsSync(opensaasCli) &&
+  existsSync(coreDist) &&
+  existsSync(authDist) &&
+  existsSync(path.join(toolchainNodeModules, '.bin', 'opensaas')) &&
+  existsSync(path.join(toolchainNodeModules, '.bin', 'prisma')) &&
+  existsSync(path.join(toolchainNodeModules, '@prisma', 'adapter-better-sqlite3'))
+
+/** The temp project's `opensaas.config.ts`: sqlite + the MCP plugin + self-service account deletion enabled. */
+function configSource(): string {
+  return `import { config } from '@opensaas/stack-core'
+import { authPlugin } from '@opensaas/stack-auth'
+import { mcp } from '@opensaas/stack-auth/plugins'
+import { jwt } from 'better-auth/plugins'
+import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3'
+
+export default config({
+  plugins: [
+    authPlugin({
+      emailAndPassword: { enabled: true },
+      // better-auth 1.7's mcp() is built on the OAuth Provider, which issues
+      // JWT-based access tokens and requires better-auth's own jwt() plugin
+      // to be registered alongside it (throws BetterAuthError: jwt_config
+      // otherwise) — see @better-auth/mcp's own usage example.
+      betterAuthPlugins: [
+        jwt(),
+        mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'http://localhost:3000/api/mcp' }),
+      ],
+      // Not modelled by AuthConfig — passed through verbatim so /delete-user
+      // deletes immediately instead of requiring an email-verification
+      // round trip (see packages/auth/CLAUDE.md, "betterAuthOptions").
+      // baseURL is explicit rather than relying on the BETTER_AUTH_URL env
+      // var: better-auth 1.7's OAuth Provider needs a resolvable URL to build
+      // its own endpoint/issuer URLs during init, and this test constructs
+      // \`auth\` in-process via createAuth() (not through the CLI subprocess
+      // that does see BETTER_AUTH_URL), so the auto-detected origin would be
+      // undefined here.
+      betterAuthOptions: {
+        baseURL: 'http://localhost:3000',
+        user: { deleteUser: { enabled: true } },
+      },
+    }),
+  ],
+  db: {
+    provider: 'sqlite',
+    prismaClientConstructor: (PrismaClient) => {
+      const adapter = new PrismaBetterSqlite3({ url: process.env.DATABASE_URL || './dev.db' })
+      return new PrismaClient({ adapter })
+    },
+  },
+  lists: {},
+})
+`
+}
+
+/** Scaffold a fresh temp project with the MCP plugin enabled and push its schema. Returns the project dir. */
+async function setupProject(): Promise<string> {
+  const tmpRoot = await fsp.mkdtemp(path.join(os.tmpdir(), 'opensaas-mcp-cascade-e2e-'))
+  const dir = path.join(tmpRoot, 'project')
+  await fsp.mkdir(dir, { recursive: true })
+
+  await fsp.writeFile(path.join(dir, 'opensaas.config.ts'), configSource())
+  await fsp.writeFile(
+    path.join(dir, 'package.json'),
+    JSON.stringify(
+      { name: 'mcp-cascade-e2e-project', version: '0.0.0', private: true, type: 'module' },
+      null,
+      2,
+    ),
+  )
+  await fsp.writeFile(path.join(dir, '.env'), 'DATABASE_URL=file:./dev.db\n')
+  await fsp.symlink(toolchainNodeModules, path.join(dir, 'node_modules'))
+
+  const env = {
+    ...process.env,
+    DATABASE_URL: 'file:./dev.db',
+    BETTER_AUTH_SECRET: 'e2e-test-secret-not-for-production-0000000000',
+    BETTER_AUTH_URL: 'http://localhost:3000',
+  }
+  const binDir = path.join(dir, 'node_modules', '.bin')
+  await run(path.join(binDir, 'opensaas'), ['generate'], { cwd: dir, env })
+  await run(path.join(binDir, 'prisma'), ['db', 'push'], { cwd: dir, env })
+
+  return dir
+}
+
+/** Import the temp project's config + generated context and build a real auth instance via `createAuth()`. */
+async function createAuthInstanceForProject(dir: string) {
+  process.env.DATABASE_URL = `file:${path.join(dir, 'dev.db')}`
+
+  // `@vite-ignore` suppresses Vite's static analysis of this computed,
+  // external (outside the package root) specifier.
+  const config = (
+    (await import(/* @vite-ignore */ pathToFileURL(path.join(dir, 'opensaas.config.ts')).href)) as {
+      default: OpenSaasConfig | Promise<OpenSaasConfig>
+    }
+  ).default
+  const { rawOpensaasContext } = (await import(
+    /* @vite-ignore */ pathToFileURL(path.join(dir, '.opensaas/context.ts')).href
+  )) as { rawOpensaasContext: Promise<AccessContext> }
+
+  const resolvedContext = await rawOpensaasContext
+  return { auth: createAuth(config, resolvedContext), context: resolvedContext }
+}
+
+async function cleanupProject(dir: string): Promise<void> {
+  // See rate-limit-e2e.test.ts for why this global must be cleared between projects.
+  delete (globalThis as { prisma?: unknown }).prisma
+
+  const linkPath = path.join(dir, 'node_modules')
+  if (existsSync(linkPath)) {
+    await fsp.unlink(linkPath)
+  }
+  await fsp.rm(path.dirname(dir), { recursive: true, force: true })
+}
+
+describe.skipIf(!prerequisitesPresent)(
+  'MCP plugin OAuth tables cascade on user deletion — live end-to-end (issue #992)',
+  () => {
+    it('deleting a user via better-auth’s own /delete-user removes their OAuth clients, access tokens and consents; another user’s rows survive', async () => {
+      const dir = await setupProject()
+      try {
+        const { auth, context } = await createAuthInstanceForProject(dir)
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- the temp project's own generated Prisma Client, not a type this package can import
+        const prisma = context.prisma as any
+
+        const { headers: deletedHeaders } = await auth.api.signUpEmail({
+          body: { email: 'deleted@example.com', password: 'password1234', name: 'Deleted User' },
+          returnHeaders: true,
+        })
+        const deletedCookie = deletedHeaders.get('set-cookie') ?? ''
+        const deletedSession = await auth.api.getSession({
+          headers: new Headers({ cookie: deletedCookie }),
+        })
+        const deletedUserId = deletedSession!.user.id
+
+        const { headers: survivorHeaders } = await auth.api.signUpEmail({
+          body: { email: 'survivor@example.com', password: 'password1234', name: 'Survivor User' },
+          returnHeaders: true,
+        })
+        const survivorSession = await auth.api.getSession({
+          headers: new Headers({ cookie: survivorHeaders.get('set-cookie') ?? '' }),
+        })
+        const survivorUserId = survivorSession!.user.id
+
+        // OAuth rows are created through the raw Prisma client — these lists
+        // ship closed (ADR-0013), and this is the same path better-auth's own
+        // OAuth flows write through in production. better-auth 1.7's OAuth
+        // Provider (issue #986) splits what the pre-1.7 MCP plugin modelled
+        // as a single "application" with embedded access/refresh tokens into
+        // oauthClient (the registered client) plus a standalone
+        // oauthAccessToken (no more combined access+refresh token row).
+        for (const [suffix, userId] of [
+          ['deleted', deletedUserId],
+          ['survivor', survivorUserId],
+        ]) {
+          await prisma.oauthClient.create({
+            data: {
+              name: `App ${suffix}`,
+              clientId: `client-${suffix}`,
+              redirectUris: 'http://localhost/callback',
+              userId,
+            },
+          })
+          await prisma.oauthAccessToken.create({
+            data: {
+              token: `access-${suffix}`,
+              clientId: `client-${suffix}`,
+              scopes: 'openid',
+              expiresAt: new Date(Date.now() + 3_600_000),
+              // oauthAccessToken declares createdAt but not updatedAt
+              // upstream, so it derives as an ordinary required column with
+              // no DB-level default (see hasSymmetricTimestamps in
+              // derive-auth-lists.ts) — better-auth's own adapter always
+              // supplies it explicitly, so this raw-Prisma seed must too.
+              createdAt: new Date(),
+              userId,
+            },
+          })
+          await prisma.oauthConsent.create({
+            data: { clientId: `client-${suffix}`, scopes: 'openid', userId },
+          })
+        }
+
+        expect(await prisma.oauthClient.count()).toBe(2)
+        expect(await prisma.oauthAccessToken.count()).toBe(2)
+        expect(await prisma.oauthConsent.count()).toBe(2)
+
+        const deleteResult = await auth.api.deleteUser({
+          body: {},
+          headers: new Headers({ cookie: deletedCookie }),
+        })
+        expect(deleteResult).toEqual({ success: true, message: 'User deleted' })
+
+        expect(await prisma.user.findUnique({ where: { id: deletedUserId } })).toBeNull()
+
+        // No orphans: every row belonging to the deleted user is gone via the
+        // database cascade, not just the user row itself.
+        expect(await prisma.oauthClient.findFirst({ where: { userId: deletedUserId } })).toBeNull()
+        expect(
+          await prisma.oauthAccessToken.findFirst({ where: { userId: deletedUserId } }),
+        ).toBeNull()
+        expect(await prisma.oauthConsent.findFirst({ where: { userId: deletedUserId } })).toBeNull()
+
+        // The other user's rows are untouched — the cascade is scoped to the
+        // deleted user's own foreign key, not a wholesale table wipe.
+        expect(await prisma.user.findUnique({ where: { id: survivorUserId } })).not.toBeNull()
+        expect(await prisma.oauthClient.count()).toBe(1)
+        expect(await prisma.oauthAccessToken.count()).toBe(1)
+        expect(await prisma.oauthConsent.count()).toBe(1)
+
+        await context.prisma.$disconnect()
+      } finally {
+        await cleanupProject(dir)
+      }
+    }, 120_000)
+  },
+)
+
+// Surface, in a normal unit run, why this guard was skipped.
+describe.runIf(!prerequisitesPresent)('MCP OAuth cascade e2e (skipped)', () => {
+  it('runs only in the e2e job (set RUN_MCP_OAUTH_CASCADE_E2E=1 after install + build)', () => {
+    expect(prerequisitesPresent).toBe(false)
+  })
+})

package/tests/plugin-derived-keys.test.ts

@@ -209,6 +209,45 @@ describe('authPlugin - add-vs-extend with derived keys', () => {
     // ...or its access config.
     expect(authUser.access?.operation?.query).toBe(userQuery)
   })
+
+  it('keeps a plugin-table credential field read-denied even when the app redeclares that list and field (issue #1014)', async () => {
+    // An app opening a plugin-derived list the documented way (declaring the
+    // list itself under the derived key) merges in via extendList — field
+    // additions win over the app's own field of the same key (core's
+    // extendList spreads `extension.fields` last), so the derived,
+    // read-denied clientSecret must survive even though the app also
+    // declares a `clientSecret` field on its own `OauthClient` list.
+    const mcpBetterAuthPlugin = {
+      id: 'test-mcp',
+      schema: {
+        oauthClient: {
+          fields: {
+            clientSecret: { type: 'string' as const, required: false },
+            name: { type: 'string' as const, required: false },
+          },
+        },
+      },
+    }
+
+    const result = await config({
+      db: { provider: 'sqlite' },
+      plugins: [authPlugin({ betterAuthPlugins: [mcpBetterAuthPlugin] })],
+      lists: {
+        OauthClient: list({
+          fields: { clientSecret: text() },
+          access: { operation: { query: () => true } },
+        }),
+      },
+    })
+
+    const oauthClient = result.lists.OauthClient
+    expect(oauthClient.fields.clientSecret.access?.read).toBeTypeOf('function')
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal read-access call fixture
+    expect(await oauthClient.fields.clientSecret.access!.read!({} as any)).toBe(false)
+    // The app's own access survives (extendList never forwards access).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- access control parameters are runtime values
+    expect(oauthClient.access?.operation?.query?.({} as any)).toBe(true)
+  })
 })
 
 describe('authPlugin - runtime user-key resolution', () => {

package/tests/plugin-table-derivation.test.ts

@@ -0,0 +1,270 @@
+import { describe, it, expect, vi } from 'vitest'
+import { mcp } from '@better-auth/mcp'
+import { deriveAuthLists } from '../src/config/derive-auth-lists.js'
+import type { NormalizedAuthModels } from '../src/config/types.js'
+
+/**
+ * Coverage for the consolidated plugin-table derivation (issue #992):
+ * `deriveAuthLists` now covers better-auth plugin tables (e.g. the MCP
+ * plugin's OAuth tables) through the same registry and field-derivation pass
+ * as the four base models, instead of a separate converter that dropped
+ * references to bare columns. See `auth-lists-drift.test.ts` for a
+ * field-by-field comparison against better-auth's own table definitions, and
+ * `generated-fk-shape.test.ts` for the generated-schema-text assertions.
+ */
+
+const defaultModels: NormalizedAuthModels = {
+  user: { modelName: 'User', fields: {} },
+  session: { modelName: 'Session', fields: {} },
+  account: { modelName: 'Account', fields: {} },
+  verification: { modelName: 'Verification', fields: {} },
+}
+
+describe('deriveAuthLists — better-auth plugin tables (issue #992)', () => {
+  it('derives every MCP OAuth table under a PascalCase key, mapped back to its camelCase physical table', () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [
+      mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'https://example.com/mcp' }),
+    ])
+
+    expect(Object.keys(lists).sort()).toEqual([
+      'Account',
+      'OauthAccessToken',
+      'OauthClient',
+      'OauthClientAssertion',
+      'OauthClientResource',
+      'OauthConsent',
+      'OauthRefreshToken',
+      'OauthResource',
+      'Session',
+      'User',
+      'Verification',
+    ])
+    expect(lists.OauthClient.db?.map).toBe('oauthClient')
+    expect(lists.OauthAccessToken.db?.map).toBe('oauthAccessToken')
+    expect(lists.OauthConsent.db?.map).toBe('oauthConsent')
+  })
+
+  it('generates a real relationship (not a bare column) for a PK-targeting reference (userId -> user.id)', () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [
+      mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'https://example.com/mcp' }),
+    ])
+    const userField = lists.OauthClient.fields.user
+
+    expect(userField.type).toBe('relationship')
+    expect(userField.ref).toBe('User.oauthClients')
+    expect(userField.db?.foreignKey).toEqual({ map: 'userId' })
+    // oauthClient.userId is optional upstream (required: false).
+    expect(userField.db?.isNullable).toBe(true)
+  })
+
+  it('carries the referential action from `onDelete: cascade` through to the generated relation', () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [
+      mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'https://example.com/mcp' }),
+    ])
+    const userField = lists.OauthClient.fields.user
+    const extend = userField.db?.extendPrismaSchema
+    const relationLine = extend
+      ? extend({ relationLine: '@relation(fields: [x], references: [id])' }).relationLine
+      : ''
+
+    expect(relationLine).toContain('onDelete: Cascade')
+  })
+
+  it('maps every declared referential action, not just cascade', () => {
+    const plugin = {
+      id: 'test-referential-actions',
+      schema: {
+        widget: {
+          modelName: 'widget',
+          fields: {
+            ownerId: {
+              type: 'string',
+              required: true,
+              references: { model: 'user', field: 'id', onDelete: 'restrict' as const },
+            },
+          },
+        },
+      },
+    }
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [plugin])
+    const extend = lists.Widget.fields.owner.db?.extendPrismaSchema
+    const relationLine = extend
+      ? extend({ relationLine: '@relation(fields: [x], references: [id])' }).relationLine
+      : ''
+
+    expect(relationLine).toContain('onDelete: Restrict')
+  })
+
+  it('leaves a non-PK-targeting reference as a plain scalar column (clientId -> oauthClient.clientId)', () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [
+      mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'https://example.com/mcp' }),
+    ])
+    const clientId = lists.OauthAccessToken.fields.clientId
+
+    expect(clientId.type).toBe('text')
+    expect(clientId).not.toHaveProperty('ref')
+    // Still indexed, since better-auth declares `index: true` on this column.
+    expect(clientId.isIndexed).toBe(true)
+    expect(clientId.validation?.isRequired).toBe(true)
+  })
+
+  it('adds a reverse relation on the target base list for every plugin-table reference to it, with no name collisions', () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [
+      mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'https://example.com/mcp' }),
+    ])
+
+    expect(lists.User.fields.oauthClients).toMatchObject({
+      type: 'relationship',
+      ref: 'OauthClient.user',
+      many: true,
+    })
+    expect(lists.User.fields.oauthAccessTokens).toMatchObject({
+      type: 'relationship',
+      ref: 'OauthAccessToken.user',
+      many: true,
+    })
+    expect(lists.User.fields.oauthConsents).toMatchObject({
+      type: 'relationship',
+      ref: 'OauthConsent.user',
+      many: true,
+    })
+  })
+
+  it('honours fieldName column maps and index: true on plugin scalar fields', () => {
+    const plugin = {
+      id: 'test-column-map',
+      schema: {
+        widget: {
+          modelName: 'widget',
+          fields: {
+            label: { type: 'string', fieldName: 'display_label', index: true },
+          },
+        },
+      },
+    }
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [plugin])
+    const label = lists.Widget.fields.label
+
+    expect(label.db?.map).toBe('display_label')
+    expect(label.isIndexed).toBe(true)
+  })
+
+  it('ships plugin-table lists closed — no access control', () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [
+      mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'https://example.com/mcp' }),
+    ])
+
+    expect(lists.OauthClient.access).toBeUndefined()
+    expect(lists.OauthAccessToken.access).toBeUndefined()
+    expect(lists.OauthConsent.access).toBeUndefined()
+  })
+
+  it('sets no db.map when a plugin already declares a PascalCase modelName', () => {
+    const plugin = {
+      id: 'test-passkey',
+      schema: { passkey: { modelName: 'Passkey', fields: { publicKey: { type: 'string' } } } },
+    }
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [plugin])
+
+    expect(lists).toHaveProperty('Passkey')
+    expect(lists.Passkey.db?.map).toBeUndefined()
+  })
+
+  it('PascalCases a snake_case schema key with no modelName override', () => {
+    const plugin = {
+      id: 'test-snake-case',
+      schema: { oauth_widget: { fields: { data: { type: 'string' } } } },
+    }
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [plugin])
+
+    expect(lists).toHaveProperty('OauthWidget')
+    expect(lists.OauthWidget.db?.map).toBe('oauth_widget')
+  })
+
+  it('throws a clear error when a plugin table references a model outside the registry', () => {
+    const plugin = {
+      id: 'test-bad-reference',
+      schema: {
+        widget: {
+          modelName: 'widget',
+          fields: {
+            ownerId: {
+              type: 'string',
+              references: { model: 'nonexistentModel', field: 'id' },
+            },
+          },
+        },
+      },
+    }
+
+    expect(() => deriveAuthLists(defaultModels, {}, {}, [plugin])).toThrow(
+      /widget\.ownerId.*references unknown model "nonexistentModel"/,
+    )
+  })
+
+  it('throws a clear error instead of silently colliding when two id-references on the same table target the same model', () => {
+    const plugin = {
+      id: 'test-reverse-collision',
+      schema: {
+        widget: {
+          modelName: 'widget',
+          fields: {
+            ownerId: { type: 'string', references: { model: 'user', field: 'id' } },
+            reviewerId: { type: 'string', references: { model: 'user', field: 'id' } },
+          },
+        },
+      },
+    }
+
+    expect(() => deriveAuthLists(defaultModels, {}, {}, [plugin])).toThrow(
+      /"widget" has more than one reference to "user".*"widgets"/,
+    )
+  })
+
+  it('falls back to a text() column with a warning for a better-auth field type this derivation does not model (e.g. json)', () => {
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    try {
+      const plugin = {
+        id: 'test-unsupported-type',
+        schema: {
+          widget: { modelName: 'widget', fields: { metadata: { type: 'json' } } },
+        },
+      }
+
+      const { lists } = deriveAuthLists(defaultModels, {}, {}, [plugin])
+
+      expect(lists.Widget.fields.metadata.type).toBe('text')
+      expect(warn).toHaveBeenCalledWith(
+        expect.stringContaining('Unknown better-auth field type "json"'),
+      )
+    } finally {
+      warn.mockRestore()
+    }
+  })
+
+  it('merges a plugin schema extension of a base model directly into that base list, without a separate table', () => {
+    const anonymousPlugin = {
+      id: 'anonymous',
+      schema: { user: { fields: { isAnonymous: { type: 'boolean', required: false } } } },
+    }
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [anonymousPlugin])
+
+    expect(Object.keys(lists).sort()).toEqual(['Account', 'Session', 'User', 'Verification'])
+    expect(lists.User.fields).toHaveProperty('isAnonymous')
+  })
+
+  it('resolves a plugin table reference to a base model through a modelName remap (e.g. AuthUser)', () => {
+    const remappedModels: NormalizedAuthModels = {
+      user: { modelName: 'AuthUser', fields: {} },
+      session: { modelName: 'AuthSession', fields: {} },
+      account: { modelName: 'AuthAccount', fields: {} },
+      verification: { modelName: 'AuthVerification', fields: {} },
+    }
+    const { lists } = deriveAuthLists(remappedModels, {}, {}, [
+      mcp({ loginPage: '/sign-in', consentPage: '/consent', resource: 'https://example.com/mcp' }),
+    ])
+
+    expect(lists.OauthClient.fields.user.ref).toBe('AuthUser.oauthClients')
+    expect(lists.AuthUser.fields.oauthClients).toBeDefined()
+  })
+})