github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

setActiveOrganization cannot be disabled. Add allowUserToSetOrganization similar to allowUserToCreateOrganization #1657

New Issue
Closed
opened 2026-03-13 08:54:07 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-13 08:54:07 -05:00
Owner
Copy Link

Originally created by @abraxas on GitHub (Aug 7, 2025).

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

Here's my use case. I have a fairly robust tenant imitation system where admins can imitate members of their organization. Because setActiveOrganization is public to the active user, there's really no way to stop a savvy user from leaking into other users after they imitate the user in question.

Describe the solution you'd like

The most "betterAuth"-like solution would be to mimic allowUserToCreateOrganization with a similar allowUserToSetOrganization method. And I could add a secret to the headers when calling it from a server and look for that secret when receiving that call.

Describe alternatives you've considered

I also considered adding more enable/disable functionality to the organization plugin with booleans instead of permission methods. My current solution is a very specialized server-side component that tries to capture an organization change from anything other than "null". None of them were sensible.

In an ideal world, however, I'd have a server-only method I could call that would set the organization and override permissions, and make sure the session refreshes (doing my own authorization and not needing to pass the session of a logged-in user). There doesn't seem to be anything in betterAuth that behaves this way, so I'm not going to pitch it.

Additional context

No response

Originally created by @abraxas on GitHub (Aug 7, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. Here's my use case. I have a fairly robust tenant imitation system where admins can imitate members of their organization. Because setActiveOrganization is public to the active user, there's really no way to stop a savvy user from leaking into other users after they imitate the user in question. ### Describe the solution you'd like The most "betterAuth"-like solution would be to mimic allowUserToCreateOrganization with a similar allowUserToSetOrganization method. And I could add a secret to the headers when calling it from a server and look for that secret when receiving that call. ### Describe alternatives you've considered I also considered adding more enable/disable functionality to the organization plugin with booleans instead of permission methods. My current solution is a very specialized server-side component that tries to capture an organization change from anything other than "null". None of them were sensible. In an ideal world, however, I'd have a server-only method I could call that would set the organization and override permissions, and make sure the session refreshes (doing my own authorization and not needing to pass the session of a logged-in user). There doesn't seem to be anything in betterAuth that behaves this way, so I'm not going to pitch it. ### Additional context _No response_
GiteaMirror added the enhancement label 2026-03-13 08:54:07 -05:00
GiteaMirror commented 2026-03-13 08:54:08 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Nov 6, 2025):

Hi, @abraxas. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested a new permission, allowUserToSetOrganization, to complement allowUserToCreateOrganization.
  • The goal is to prevent users from improperly changing active organizations, especially during admin impersonation.
  • You proposed a secure, server-only method to set the organization and refresh sessions without relying on user permissions.
  • There have been no further comments or updates on this feature request.

Next Steps:

  • Please let me know if this issue is still relevant to the latest version of better-auth by commenting here.
  • If I don’t hear back within 7 days, I will automatically close this issue.

Thanks for your understanding and contribution!

@dosubot[bot] commented on GitHub (Nov 6, 2025): Hi, @abraxas. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested a new permission, `allowUserToSetOrganization`, to complement `allowUserToCreateOrganization`. - The goal is to prevent users from improperly changing active organizations, especially during admin impersonation. - You proposed a secure, server-only method to set the organization and refresh sessions without relying on user permissions. - There have been no further comments or updates on this feature request. **Next Steps:** - Please let me know if this issue is still relevant to the latest version of better-auth by commenting here. - If I don’t hear back within 7 days, I will automatically close this issue. Thanks for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#1657
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?