parity(auth): add custom_claims_allowlist to custom providers admin API [from supabase-js]

[grdsdev]

Warning

Auto-generated parity issue — may be a false positive.

This issue was created automatically by /sync-sdk-parity from a heuristic
analysis of recent supabase-js commits. The tooling has limited insight
into language-specific idioms and may have:

• misidentified a JS-only change as cross-language relevant,
• missed an existing implementation in this SDK under a different name,
• or proposed an API shape that doesn't fit this language's conventions.

It is the SDK author's responsibility to validate the need before
implementing. If this change does not apply to this SDK, please close the
issue with a short note explaining why.

---

SDK Parity: C# implementation needed

A change was made in supabase-js that may need to be implemented in this repository for SDK parity. Please confirm applicability before starting work.

Reference Implementation (supabase-js)

• Commit: 84393f1b
• PR: feat(auth): add custom_claims_allowlist to custom providers admin API supabase/supabase-js#2473
• Module: auth
• Type: new-feature

What Changed

Added custom_claims_allowlist?: string[] to CustomOAuthProvider, CreateCustomProviderParams, and UpdateCustomProviderParams types. Allows specifying which raw identity provider claim keys to copy into the user's custom_claims field.

Code Reference

type CreateCustomProviderParams = {
  // ...
  custom_claims_allowlist?: string[]  // e.g. ["groups", "org_id", "mail"]
  // ...
}

Implementation Guidance

Expected API Surface (C#)

public class CreateCustomOAuthProviderOptions {
    // ...
    [JsonProperty("custom_claims_allowlist")]
    public List<string>? CustomClaimsAllowlist { get; set; }
    // ...
}

// Usage
await client.Auth.Admin.CreateProviderAsync(new CreateCustomOAuthProviderOptions {
    // ...
    CustomClaimsAllowlist = new List<string> { "groups", "org_id", "mail" }
});

Key Behaviors to Match

• Optional List<string>? defaulting to null (omitted from JSON when null)
• JSON serialized as custom_claims_allowlist
• Present in create, update, and response types for custom OAuth providers
• Independent from attribute mapping

Acceptance Criteria

• CustomClaimsAllowlist: List<string>? in create/update/read types
• [JsonProperty("custom_claims_allowlist")] or equivalent
• Null by default (omitted from JSON)
• Unit tests for JSON serialization

Context

• supabase-js version: v2.110.0
• Parity tracking: Auto-generated by SDK parity analysis
• Related Linear issues: SDK-1173 (dart), SDK-1174 (py), SDK-1175 (swift)

---

Generated with Claude Code /sync-sdk-parity