github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-31 10:23:24 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

feat(admin): allow creating users without admin session on server api

Browse Source
This commit is contained in:
Bereket Engida
2025-03-16 00:02:07 +03:00
parent 01082c5531
commit f2520f95e9
2 changed files with 69 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/better-auth/src/plugins/admin/admin.test.ts
+46 -26
View File
@@ -6,37 +6,42 @@ import { createAccessControl } from "../access";
import { createAuthClient } from "../../client";
describe("Admin plugin", async () => {
const { signInWithTestUser, signInWithUser, cookieSetter, customFetchImpl } =
await getTestInstance(
{
plugins: [
admin({
bannedUserMessage: "Custom banned user message",
}),
],
databaseHooks: {
user: {
create: {
before: async (user) => {
if (user.name === "Admin") {
return {
data: {
...user,
role: "admin",
},
};
}
},
const {
auth,
signInWithTestUser,
signInWithUser,
cookieSetter,
customFetchImpl,
} = await getTestInstance(
{
plugins: [
admin({
bannedUserMessage: "Custom banned user message",
}),
],
databaseHooks: {
user: {
create: {
before: async (user) => {
if (user.name === "Admin") {
return {
data: {
...user,
role: "admin",
},
};
}
},
},
},
},
{
testUser: {
name: "Admin",
},
},
{
testUser: {
name: "Admin",
},
);
},
);
const client = createAuthClient({
fetchOptions: {
customFetchImpl,
@@ -530,6 +535,21 @@ describe("Admin plugin", async () => {
);
expect(res.error?.status).toBe(403);
});
it("should allow creating users from server", async () => {
const res = await auth.api.createUser({
body: {
email: "test2@test.com",
password: "password",
name: "Test User",
},
});
expect(res.user).toMatchObject({
email: "test2@test.com",
name: "Test User",
role: "user",
});
});
});
describe("access control", async (it) => {
packages/better-auth/src/plugins/admin/admin.ts
+23 -17
View File
@@ -277,9 +277,11 @@ export const admin = <O extends AdminOptions>(options?: O) => {
name: z.string({
description: "The name of the user",
}),
role: z.string({
description: "The role of the user",
}),
role: z
.string({
description: "The role of the user",
})
.optional(),
/**
* extra fields for user
*/
@@ -290,7 +292,6 @@ export const admin = <O extends AdminOptions>(options?: O) => {
}),
),
}),
use: [adminMiddleware],
metadata: {
openapi: {
operationId: "createUser",
@@ -317,19 +318,24 @@ export const admin = <O extends AdminOptions>(options?: O) => {
},
},
async (ctx) => {
const session = ctx.context.session;
const canCreateUser = hasPermission({
userId: ctx.context.session.user.id,
role: session.user.role,
options: opts,
permission: {
user: ["create"],
},
});
if (!canCreateUser) {
throw new APIError("FORBIDDEN", {
message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS,
const session = await getSessionFromCtx<{ role: string }>(ctx);
if (!session && (ctx.request || ctx.headers)) {
throw ctx.error("UNAUTHORIZED");
}
if (session) {
const canCreateUser = hasPermission({
userId: session.user.id,
role: session.user.role,
options: opts,
permission: {
user: ["create"],
},
});
if (!canCreateUser) {
throw new APIError("FORBIDDEN", {
message: ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS,
});
}
}
const existUser = await ctx.context.internalAdapter.findUserByEmail(
ctx.body.email,
@@ -343,7 +349,7 @@ export const admin = <O extends AdminOptions>(options?: O) => {
await ctx.context.internalAdapter.createUser<UserWithRole>({
email: ctx.body.email,
name: ctx.body.name,
role: ctx.body.role,
role: ctx.body.role ?? options?.defaultRole ?? "user",
...ctx.body.data,
});