github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-22 16:42:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #9072] [MERGED] fix: incorrect operationId in password reset callback endpoint #16664

New Issue
Closed
opened 2026-04-13 10:38:09 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 10:38:09 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/9072
Author: @ramonclaudio
Created: 4/9/2026
Status: ✅ Merged
Merged: 4/9/2026
Merged by: @ping-maxwell

Base: main ← Head: chore/rename-forget-to-forgot

📝 Commits (4)

  • 03f6379 fix(api): align password reset callback operation id with openapi
  • a4c8382 chore(demo): rename forget-password to forgot-password
  • 3f08e84 Merge branch 'main' into chore/rename-forget-to-forgot
  • af34a1c Merge branch 'main' into chore/rename-forget-to-forgot

📊 Changes

8 files changed (+25 additions, -20 deletions)

View changed files

➕ .changeset/fix-password-reset-callback-operation-id.md (+5 -0)
📝 demo/expo/src/app/forgot-password.tsx (+3 -3)
📝 demo/expo/src/app/index.tsx (+2 -2)
📝 demo/nextjs/app/(auth)/forgot-password/page.tsx (+2 -2)
📝 demo/nextjs/components/forms/forgot-password-form.tsx (+10 -10)
📝 demo/nextjs/components/forms/sign-in-form.tsx (+1 -1)
📝 packages/better-auth/src/api/routes/password.test.ts (+1 -1)
📝 packages/better-auth/src/api/routes/password.ts (+1 -1)

📄 Description

Fixes an incorrect top-level operationId on requestPasswordResetCallback. The top-level field feeds the OpenTelemetry span attribute ATTR_OPERATION_ID (via getOperationId in api/to-auth-endpoints.ts), while the OpenAPI generator reads metadata.openapi.operationId. On this route they were out of sync: OpenAPI said resetPasswordCallback but OTel was tagged forgetPasswordCallback, a leftover from the old /forget-password route name. Every other endpoint that sets both fields (e.g. email-verification.ts:82+96, oauth-proxy/index.ts:138+143) keeps them matching; this route was the only outlier.

Bundled a forget to forgot cleanup pass on places unrelated to the deprecated /forget-password/email-otp flow:

  • packages/better-auth/src/api/routes/password.ts:156: top-level operationId to resetPasswordCallback
  • packages/better-auth/src/api/routes/password.test.ts:6: describe("forget password") to describe("forgot password")
  • demo/nextjs: (auth)/forget-password/ directory, forget-password-form.tsx, Forget* identifiers, sign-in-form.tsx href
  • demo/expo: forget-password.tsx file, index.tsx route push and button text. Also fixes a broken authClient.forgetPassword(...) call (method does not exist on the current client) by switching to authClient.requestPasswordReset(...)

Untouched on purpose: the deprecated /forget-password/email-otp endpoint, its "forget-password" OTP type literal, the forget-password-otp- identifier prefix, the forgetPasswordEmailOTP export, the rate-limiter matcher, the email-otp docs that describe those literals, and the 1-4.mdx / 1-5.mdx blog history. Renaming any of those would invalidate stored OTPs and break consumers still on the deprecated path.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/9072 **Author:** [@ramonclaudio](https://github.com/ramonclaudio) **Created:** 4/9/2026 **Status:** ✅ Merged **Merged:** 4/9/2026 **Merged by:** [@ping-maxwell](https://github.com/ping-maxwell) **Base:** `main` ← **Head:** `chore/rename-forget-to-forgot` --- ### 📝 Commits (4) - [`03f6379`](https://github.com/better-auth/better-auth/commit/03f63792f0635dd681dd203b1c094202578378e1) fix(api): align password reset callback operation id with openapi - [`a4c8382`](https://github.com/better-auth/better-auth/commit/a4c83824216810b2cee744968b15c3feef44944d) chore(demo): rename forget-password to forgot-password - [`3f08e84`](https://github.com/better-auth/better-auth/commit/3f08e849f56bd71aad271acfa173a36ba77e7856) Merge branch 'main' into chore/rename-forget-to-forgot - [`af34a1c`](https://github.com/better-auth/better-auth/commit/af34a1c127323368b911ebc3581f634bdc8636c2) Merge branch 'main' into chore/rename-forget-to-forgot ### 📊 Changes **8 files changed** (+25 additions, -20 deletions) <details> <summary>View changed files</summary> ➕ `.changeset/fix-password-reset-callback-operation-id.md` (+5 -0) 📝 `demo/expo/src/app/forgot-password.tsx` (+3 -3) 📝 `demo/expo/src/app/index.tsx` (+2 -2) 📝 `demo/nextjs/app/(auth)/forgot-password/page.tsx` (+2 -2) 📝 `demo/nextjs/components/forms/forgot-password-form.tsx` (+10 -10) 📝 `demo/nextjs/components/forms/sign-in-form.tsx` (+1 -1) 📝 `packages/better-auth/src/api/routes/password.test.ts` (+1 -1) 📝 `packages/better-auth/src/api/routes/password.ts` (+1 -1) </details> ### 📄 Description Fixes an incorrect top-level `operationId` on `requestPasswordResetCallback`. The top-level field feeds the OpenTelemetry span attribute `ATTR_OPERATION_ID` (via `getOperationId` in `api/to-auth-endpoints.ts`), while the OpenAPI generator reads `metadata.openapi.operationId`. On this route they were out of sync: OpenAPI said `resetPasswordCallback` but OTel was tagged `forgetPasswordCallback`, a leftover from the old `/forget-password` route name. Every other endpoint that sets both fields (e.g. `email-verification.ts:82+96`, `oauth-proxy/index.ts:138+143`) keeps them matching; this route was the only outlier. Bundled a `forget` to `forgot` cleanup pass on places unrelated to the deprecated `/forget-password/email-otp` flow: - `packages/better-auth/src/api/routes/password.ts:156`: top-level `operationId` to `resetPasswordCallback` - `packages/better-auth/src/api/routes/password.test.ts:6`: `describe("forget password")` to `describe("forgot password")` - `demo/nextjs`: `(auth)/forget-password/` directory, `forget-password-form.tsx`, `Forget*` identifiers, `sign-in-form.tsx` href - `demo/expo`: `forget-password.tsx` file, `index.tsx` route push and button text. Also fixes a broken `authClient.forgetPassword(...)` call (method does not exist on the current client) by switching to `authClient.requestPasswordReset(...)` Untouched on purpose: the deprecated `/forget-password/email-otp` endpoint, its `"forget-password"` OTP type literal, the `forget-password-otp-` identifier prefix, the `forgetPasswordEmailOTP` export, the rate-limiter matcher, the email-otp docs that describe those literals, and the `1-4.mdx` / `1-5.mdx` blog history. Renaming any of those would invalidate stored OTPs and break consumers still on the deprecated path. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 10:38:09 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#16664