From a845c872421b5065a119dd595b1de614edc48d58 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 07:17:53 +0000
Subject: [PATCH] Fix agent-auth back-compat defaults

Co-Authored-By: madison@stack-auth.com <madison.w.kennedy@gmail.com>
---
 packages/shared/src/apps/apps-config.ts   |  2 ++
 packages/shared/src/config/schema.test.ts | 24 +++++++++++++++++++++++
 packages/shared/src/config/schema.ts      | 10 +++++++++-
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 packages/shared/src/config/schema.test.ts

diff --git a/packages/shared/src/apps/apps-config.ts b/packages/shared/src/apps/apps-config.ts
index 25e524580..91aaa0328 100644
--- a/packages/shared/src/apps/apps-config.ts
+++ b/packages/shared/src/apps/apps-config.ts
@@ -47,6 +47,7 @@ type App = {
   stage: "alpha" | "beta" | "stable",
   parentAppId?: ParentAppId,
   independentlyEnableable?: boolean,
+  includedInDefaultInstalledApps?: boolean,
 };
 
 export type AppId = keyof typeof ALL_APPS;
@@ -71,6 +72,7 @@ export const ALL_APPS = {
     stage: "alpha",
     parentAppId: "authentication",
     independentlyEnableable: true,
+    includedInDefaultInstalledApps: false,
   },
   "fraud-protection": {
     displayName: "Fraud Protection",
diff --git a/packages/shared/src/config/schema.test.ts b/packages/shared/src/config/schema.test.ts
new file mode 100644
index 000000000..08361d969
--- /dev/null
+++ b/packages/shared/src/config/schema.test.ts
@@ -0,0 +1,24 @@
+import { ALL_APPS } from "../apps/apps-config";
+import { applyOrganizationDefaults } from "./schema";
+import { expect } from "vitest";
+
+import.meta.vitest?.test("agent-auth is absent from default installed apps", () => {
+  const defaults = applyOrganizationDefaults({});
+
+  expect(Object.keys(defaults.apps.installed)).not.toContain("agent-auth");
+});
+
+import.meta.vitest?.test("agent-auth stays explicitly enableable", () => {
+  const defaults = applyOrganizationDefaults({
+    apps: {
+      installed: {
+        "agent-auth": {
+          enabled: true,
+        },
+      },
+    },
+  });
+
+  expect(defaults.apps.installed["agent-auth"].enabled).toBe(true);
+  expect(ALL_APPS["agent-auth"].independentlyEnableable).toBe(true);
+});
diff --git a/packages/shared/src/config/schema.ts b/packages/shared/src/config/schema.ts
index cb262800f..8e7dbadeb 100644
--- a/packages/shared/src/config/schema.ts
+++ b/packages/shared/src/config/schema.ts
@@ -293,6 +293,14 @@ const branchOnboardingSchema = yupObject({
   requireEmailVerification: yupBoolean(),
 });
 
+const installedAppIdsByDefault = typedEntries(ALL_APPS)
+  .filter(([, app]) => {
+    if ("includedInDefaultInstalledApps" in app) {
+      return false;
+    }
+    return true;
+  })
+  .map(([appId]) => appId);
 
 export const branchConfigSchema = canNoLongerBeOverridden(projectConfigSchema, [
   "sourceOfTruth",
@@ -745,7 +753,7 @@ const organizationConfigDefaults = {
   },
 
   apps: {
-    installed: typedFromEntries(appIds.map(appId => [appId, { enabled: false }])) as Record<string, { enabled: boolean } | undefined>,
+    installed: typedFromEntries(installedAppIdsByDefault.map((appId) => [appId, { enabled: false }])),
   },
 
   teams: {