github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #4272] getInvitation fails when called by an org owner/admin with YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION #18513

New Issue
Closed
opened 2026-04-15 17:00:41 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-15 17:00:41 -05:00
Owner
Copy Link

Originally created by @david-arteaga on GitHub (Aug 27, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/4272

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Create an invitation
  2. Use any authenticated owner or admin user and try to execute auth.api.getInvitation(...)
  3. better-auth throws an error if the user accessing the invitation is not the invitee:
throw new APIError("FORBIDDEN", {
    message:
        ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION,
});

Current vs. Expected behavior

I expect better-auth to return the invitation.
The docs don't mention only invitees can get their own invitations.
The API already returns all invitations when calling listInvitations. getInvitation should also work.

What version of Better Auth are you using?

1.3.7

System info

System:
    OS: macOS 15.6.1
    CPU: (10) arm64 Apple M1 Max
    Memory: 351.61 MB / 64.00 GB
    Shell: 5.9 - /bin/zsh
  Browsers:
    Brave Browser: 101.1.38.109
    Chrome: 139.0.7258.154
    Safari: 18.6

Which area(s) are affected? (Select all that apply)

Package

Auth config (if applicable)

const auth = betterAuth({
  plugins: [
    organization({
      ac,
      roles: {
        owner,
        admin,
        member,
      },
    }),
  ],
});

Additional context

I was surprised by this exception when implementing re-sending invitations.
The client sent the invitationId back to server and the backend used the getInvitation method but got an exception.
To fix this I have to call listInvitations + find(...), which is not ideal, or just drop down to accessing the DB directly, which kinda defeats the purpose of having this API which already checks permissions.

All other available methods in the organization plugin properly check permissions. The getInvitation method should do the same.

Originally created by @david-arteaga on GitHub (Aug 27, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/4272 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Create an invitation 2. Use any authenticated `owner` or `admin` user and try to execute `auth.api.getInvitation(...)` 3. better-auth [throws an error](https://github.com/better-auth/better-auth/blob/878de4e524780142546f950ffc79d9801e8af17b/packages/better-auth/src/plugins/organization/routes/crud-invites.ts#L863) if the user accessing the invitation is not the invitee: ``` throw new APIError("FORBIDDEN", { message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION, }); ``` ### Current vs. Expected behavior I expect better-auth to return the invitation. The [docs](https://www.better-auth.com/docs/plugins/organization#permissions) don't mention only invitees can get their own invitations. The API already returns all invitations when calling `listInvitations`. `getInvitation` should also work. ### What version of Better Auth are you using? 1.3.7 ### System info ```bash System: OS: macOS 15.6.1 CPU: (10) arm64 Apple M1 Max Memory: 351.61 MB / 64.00 GB Shell: 5.9 - /bin/zsh Browsers: Brave Browser: 101.1.38.109 Chrome: 139.0.7258.154 Safari: 18.6 ``` ### Which area(s) are affected? (Select all that apply) Package ### Auth config (if applicable) ```typescript const auth = betterAuth({ plugins: [ organization({ ac, roles: { owner, admin, member, }, }), ], }); ``` ### Additional context I was surprised by this exception when implementing re-sending invitations. The client sent the `invitationId` back to server and the backend used the `getInvitation` method but got an exception. To fix this I have to call `listInvitations` + `find(...)`, which is not ideal, or just drop down to accessing the DB directly, which kinda defeats the purpose of having this API which already checks permissions. All other available methods in the organization plugin properly check permissions. The `getInvitation` method should do the same.
GiteaMirror added the help wantedlockedbug labels 2026-04-15 17:00:42 -05:00
GiteaMirror commented 2026-04-15 17:00:43 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 27, 2025):

Hi @david-arteaga! I'm Dosu and I’m helping the better-auth team.

The current behavior of getInvitation is intentional: it only allows the invitee (matching email) to access the invitation, regardless of whether the requester is an org owner or admin. This restriction is enforced in the code and there is no logic to allow elevated access for owners/admins. The documentation does not mention this limitation, which can be confusing since listInvitations allows broader access for organization members, including owners and admins. As a workaround, using listInvitations and filtering by ID is the only supported way for admins/owners to access specific invitation details via the API right now. There is no in-code justification or documentation explaining why this strict invitee-only access exists for getInvitation source.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3229675401 --> @dosubot[bot] commented on GitHub (Aug 27, 2025): <!-- Greeting --> Hi @david-arteaga! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> The current behavior of `getInvitation` is intentional: it only allows the invitee (matching email) to access the invitation, regardless of whether the requester is an org owner or admin. This restriction is enforced in the code and there is no logic to allow elevated access for owners/admins. The documentation does not mention this limitation, which can be confusing since `listInvitations` allows broader access for organization members, including owners and admins. As a workaround, using `listInvitations` and filtering by ID is the only supported way for admins/owners to access specific invitation details via the API right now. There is no in-code justification or documentation explaining why this strict invitee-only access exists for `getInvitation` [source](https://github.com/better-auth/better-auth/blob/6083855a5377e3e0dbb25b4ce915eaf35ce25ed2/packages/better-auth/src/plugins/organization/routes/crud-invites.ts). <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/4d9fc453-b77b-4648-82d0-ec9d0ded8635?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/4d9fc453-b77b-4648-82d0-ec9d0ded8635?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/4d9fc453-b77b-4648-82d0-ec9d0ded8635?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/4d9fc453-b77b-4648-82d0-ec9d0ded8635?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/4d9fc453-b77b-4648-82d0-ec9d0ded8635?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/4d9fc453-b77b-4648-82d0-ec9d0ded8635?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/4d9fc453-b77b-4648-82d0-ec9d0ded8635?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/4272)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug help wanted locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#18513
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?