From 072c597500d28e7531bd5451b39bcd2e6333efe6 Mon Sep 17 00:00:00 2001
From: KinfeMichael Tariku <65047246+Kinfe123@users.noreply.github.com>
Date: Thu, 20 Feb 2025 21:52:26 +0300
Subject: [PATCH] fix(admin): impersonate user session expiration (#1471)

* fix: impersonate user session expiration

* console leak
---
 packages/better-auth/src/api/routes/session.ts  | 15 +++++++++------
 packages/better-auth/src/db/internal-adapter.ts |  2 +-
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/packages/better-auth/src/api/routes/session.ts b/packages/better-auth/src/api/routes/session.ts
index a527fc3683..dd5529846a 100644
--- a/packages/better-auth/src/api/routes/session.ts
+++ b/packages/better-auth/src/api/routes/session.ts
@@ -34,17 +34,21 @@ export const getSession = <Option extends BetterAuthOptions>() =>
 					 * and fetch the session from the database
 					 */
 					disableCookieCache: z
-						.boolean({
-							description:
-								"Disable cookie cache and fetch session from database",
-						})
-						.or(z.string().transform((v) => v === "true"))
+						.optional(
+							z
+								.boolean({
+									description:
+										"Disable cookie cache and fetch session from database",
+								})
+								.or(z.string().transform((v) => v === "true")),
+						)
 						.optional(),
 					disableRefresh: z
 						.boolean({
 							description:
 								"Disable session refresh. Useful for checking session status, without updating the session",
 						})
+						.or(z.string().transform((v) => v === "true"))
 						.optional(),
 				}),
 			),
@@ -171,7 +175,6 @@ export const getSession = <Option extends BetterAuthOptions>() =>
 					}
 					return ctx.json(null);
 				}
-
 				/**
 				 * We don't need to update the session if the user doesn't want to be remembered
 				 * or if the session refresh is disabled
diff --git a/packages/better-auth/src/db/internal-adapter.ts b/packages/better-auth/src/db/internal-adapter.ts
index 800be73578..778b5b3c28 100644
--- a/packages/better-auth/src/db/internal-adapter.ts
+++ b/packages/better-auth/src/db/internal-adapter.ts
@@ -190,7 +190,6 @@ export const createInternalAdapter = (
 			const data: Omit<Session, "id"> = {
 				ipAddress: request ? getIp(request, ctx.options) || "" : "",
 				userAgent: headers?.get("user-agent") || "",
-				...rest,
 				/**
 				 * If the user doesn't want to be remembered
 				 * set the session to expire in 1 day.
@@ -203,6 +202,7 @@ export const createInternalAdapter = (
 				token: generateId(32),
 				createdAt: new Date(),
 				updatedAt: new Date(),
+				...rest,
 			};
 			const res = await createWithHooks(
 				data,