github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #6772] Organization Plugin: Add ability to entirely remove default role #19253

New Issue
Open
opened 2026-04-15 18:06:36 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-15 18:06:36 -05:00
Owner
Copy Link

Originally created by @joshsedl on GitHub (Dec 15, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/6772

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Currently, there is no (documented) way on how to remove one of the three default roles set by this plugin (owner, admin and member).

On the organization documentation page it is only documented on how to create new roles or how to override preexisting role permissions. But there seems to be no way to delete one of the default roles.

In our case we are using both the organization and the admin plugin. This means, that we have roles logic inside a user AND a member.

The problem is, both the admin and organization plugin define an "admin" role. Which can get quite confusing, so we don't want the "admin" role inside our organization, because having two identical role names on two different authorization levels can get quite confusing.

As a current workaround, we simply overwrite the "admin" permissions with an entry json object (no permissions) and use better auth server hooks to stop user creation / invitation if an invalid role (e.g. "admin") is used for user creation / invitation. Of course this shouldn't be needed IMO.

Current vs. Expected behavior

  • Create three member roles (role1, role2 and role3)
  • Pass them to auth.ts and auth-client.ts "organization" configuration as "roles"

Expected behavior

  • Only the given roles (role1, role2 and role3) exist

Actual behavior

  • The given roles (role1, role2 and role3) exist as well as admin, member and owner

What version of Better Auth are you using?

1.4.5

System info

{
  "system": {
    "platform": "linux",
    "arch": "x64",
    "version": "#1 SMP PREEMPT_DYNAMIC Thu Jun  5 18:30:46 UTC 2025",
    "release": "6.6.87.2-microsoft-standard-WSL2",
    "cpuCount": 16,
    "cpuModel": "11th Gen Intel(R) Core(TM) i7-11800H @ 2.30GHz",
    "totalMemory": "47.05 GB",
    "freeMemory": "38.52 GB"
  },
  "node": {
    "version": "v24.1.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.3.0"
  },
  "frameworks": [
    {
      "name": "vue",
      "version": "^3.5.22"
    },
    {
      "name": "nuxt",
      "version": "^4.1.2"
    }
  ],
  "databases": [
    {
      "name": "@prisma/client",
      "version": "6.16.3"
    }
  ],
  "betterAuth": {
    "version": "^1.3.26",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

Additional context

No response

Originally created by @joshsedl on GitHub (Dec 15, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/6772 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Currently, there is no (documented) way on how to remove one of the [three default roles](https://www.better-auth.com/docs/plugins/organization#roles) set by this plugin (owner, admin and member). On the [organization documentation page](https://www.better-auth.com/docs/plugins/organization) it is only documented on how to create new roles or how to override preexisting role permissions. But there seems to be no way to delete one of the default roles. In our case we are using both the organization and the admin plugin. This means, that we have roles logic inside a user AND a member. The problem is, both the admin and organization plugin define an "admin" role. Which can get quite confusing, so we don't want the "admin" role inside our organization, because having two identical role names on two different authorization levels can get quite confusing. As a current workaround, we simply overwrite the "admin" permissions with an entry json object (no permissions) and use better auth server hooks to stop user creation / invitation if an invalid role (e.g. "admin") is used for user creation / invitation. Of course this shouldn't be needed IMO. ### Current vs. Expected behavior - Create three member roles (`role1`, `role2` and `role3`) - Pass them to auth.ts and auth-client.ts "organization" configuration as "roles" ### Expected behavior - Only the given roles (`role1`, `role2` and `role3`) exist ### Actual behavior - The given roles (`role1`, `role2` and `role3`) exist as well as `admin`, `member` and `owner` ### What version of Better Auth are you using? 1.4.5 ### System info ```bash { "system": { "platform": "linux", "arch": "x64", "version": "#1 SMP PREEMPT_DYNAMIC Thu Jun 5 18:30:46 UTC 2025", "release": "6.6.87.2-microsoft-standard-WSL2", "cpuCount": 16, "cpuModel": "11th Gen Intel(R) Core(TM) i7-11800H @ 2.30GHz", "totalMemory": "47.05 GB", "freeMemory": "38.52 GB" }, "node": { "version": "v24.1.0", "env": "development" }, "packageManager": { "name": "npm", "version": "11.3.0" }, "frameworks": [ { "name": "vue", "version": "^3.5.22" }, { "name": "nuxt", "version": "^4.1.2" } ], "databases": [ { "name": "@prisma/client", "version": "6.16.3" } ], "betterAuth": { "version": "^1.3.26", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript ``` ### Additional context _No response_
GiteaMirror added the organization label 2026-04-15 18:06:36 -05:00
GiteaMirror commented 2026-04-15 18:06:37 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Dec 15, 2025):

It's not currently possible to entirely remove the default roles (owner, admin, member) from the Better Auth organization plugin via configuration. These roles are hardcoded in the plugin and always merged with any custom roles you provide, so they persist even if you define your own set of roles. This is enforced both in the code and the type system for validation and compatibility reasons [source] [source] [source].

The current workaround—overriding the permissions for unwanted default roles (like admin) and using hooks to block their assignment—is the recommended approach for now [source]. There are several open issues and discussions tracking this limitation and the confusion it causes, especially with overlapping role names between plugins, but as of v1.4.5, there is no built-in way to remove or disable these defaults [source] [source].

If you want to follow or contribute to the ongoing discussion, you can check out these related threads:

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3655650302 --> @dosubot[bot] commented on GitHub (Dec 15, 2025): <!-- Answer --> It's not currently possible to entirely remove the default roles (`owner`, `admin`, `member`) from the Better Auth organization plugin via configuration. These roles are hardcoded in the plugin and always merged with any custom roles you provide, so they persist even if you define your own set of roles. This is enforced both in the code and the type system for validation and compatibility reasons [[source]](https://github.com/better-auth/better-auth/blob/a63e70ea27e2e936ae9915171c0e59054dc9b4a0/packages/better-auth/src/plugins/organization/organization.ts#L10-L1255) [[source]](https://github.com/better-auth/better-auth/blob/a63e70ea27e2e936ae9915171c0e59054dc9b4a0/packages/better-auth/src/plugins/organization/access/statement.ts#L3-L41) [[source]](https://github.com/better-auth/better-auth/blob/a63e70ea27e2e936ae9915171c0e59054dc9b4a0/packages/better-auth/src/plugins/organization/schema.ts#L335-L376). The current workaround—overriding the permissions for unwanted default roles (like `admin`) and using hooks to block their assignment—is the recommended approach for now [[source]](https://github.com/better-auth/better-auth/issues/6710). There are several open issues and discussions tracking this limitation and the confusion it causes, especially with overlapping role names between plugins, but as of v1.4.5, there is no built-in way to remove or disable these defaults [[source]](https://github.com/better-auth/better-auth/issues/3056) [[source]](https://github.com/better-auth/better-auth/issues/40). If you want to follow or contribute to the ongoing discussion, you can check out these related threads: - [Issue #6710: Role validation and merging of default roles](https://github.com/better-auth/better-auth/issues/6710) - [Issue #3056: Confusion between admin roles in different plugins](https://github.com/better-auth/better-auth/issues/3056) - [Issue #40: Customizable roles feature request](https://github.com/better-auth/better-auth/issues/40) <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/060e7858-4de8-408d-8b9e-501b6785ed48?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/060e7858-4de8-408d-8b9e-501b6785ed48?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/060e7858-4de8-408d-8b9e-501b6785ed48?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/060e7858-4de8-408d-8b9e-501b6785ed48?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/060e7858-4de8-408d-8b9e-501b6785ed48?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/060e7858-4de8-408d-8b9e-501b6785ed48?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/060e7858-4de8-408d-8b9e-501b6785ed48?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=It%27s%20not%20currently%20possible%20to%20entirely%20remove%20the%20default%20roles%20%28%60owner%60%2C%20%60admin%60%2C%20%60member%60%29%20from%20the%20Better%20Auth%20organization%20plugin%20via%20configuration.%20These%20roles%20are%20hardcoded%20in%20the%20plugin%20and%20always%20merged%20with%20any%20custom%20roles%20you%20provide%2C%20so%20they%20persist%20even%20if%20you%20define%20your%20own%20set%20of%20roles.%20This%20is%20enforced%20both%20in%20the%20code%20and%20the%20type%20system%20for%20validation%20and%20compatibility%20reasons%20%5B%5Bsource%5D%5D%28https%3A//github.com/better-auth/better-auth/blob/a63e70ea27e2e936ae9915171c0e59054dc9b4a0/packages/better-auth/src/plugins/organization/organization.ts%23L10-L1255%29%20%5B%5Bsource%5D%5D%28https%3A//github.com/better-auth/better-auth/blob/a63e70ea27e2e936ae9915171c0e59054dc9b4a0/packages/better-auth/src/plugins/organization/access/statement.ts%23L3-L41%29%20%5B%5Bsource%5D%5D%28https%3A//github.com/better-auth/better-auth/blob/a63e70ea27e2e936ae9915171c0e59054dc9b4a0/packages/better-auth/src/plugins/organization/schema.ts%23L335-L376%29.%0A%0AThe%20current%20workaround%E2%80%94overriding%20the%20permissions%20for%20unwanted%20default%20roles%20%28like%20%60admin%60%29%20and%20using%20hooks%20to%20block%20their%20assignment%E2%80%94is%20the%20recommended%20approach%20for%20now%20%5B%5Bsource%5D%5D%28https%3A//github.com/better-auth/better-auth/issues/6710%29.%20There%20are%20several%20open%20issues%20and%20discussions%20tracking%20this%20limitation%20and%20the%20confusion%20it%20causes%2C%20especially%20with%20overlapping%20role%20names%20between%20plugins%2C%20but%20as%20of%20v1.4.5%2C%20there%20is%20no%20built-in%20way%20to%20remove%20or%20disable%20these%20defaults%20%5B%5Bsource%5D%5D%28https%3A//github.com/better-auth/better-auth/issues/3056%29%20%5B%5Bsource%5D%5D%28https%3A//github.com/better-auth/better-auth/issues/40%29.%0A%0AIf%20you%20want%20to%20follow%20or%20contribute%20to%20the%20ongoing%20discussion%2C%20you%20can%20check%20out%20these%20related%20threads%3A%0A-%20%5BIssue%20%236710%3A%20Role%20validation%20and%20merging%20of%20default%20roles%5D%28https%3A//github.com/better-auth/better-auth/issues/6710%29%0A-%20%5BIssue%20%233056%3A%20Confusion%20between%20admin%20roles%20in%20different%20plugins%5D%28https%3A//github.com/better-auth/better-auth/issues/3056%29%0A-%20%5BIssue%20%2340%3A%20Customizable%20roles%20feature%20request%5D%28https%3A//github.com/better-auth/better-auth/issues/40%29)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/6772)
GiteaMirror commented 2026-04-15 18:06:38 -05:00
Author
Owner
Copy Link

@joshsedl commented on GitHub (Mar 25, 2026):

Why was this closed as not planned? The issues you mentioned are not about the ability to remove default roles??

<!-- gh-comment-id:4127051393 --> @joshsedl commented on GitHub (Mar 25, 2026): Why was this closed as not planned? The issues you mentioned are not about the ability to remove default roles??
GiteaMirror commented 2026-04-15 18:06:39 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 25, 2026):

@Bekacru The user joshsedl has pointed out that the issue was closed as not planned, but their concern about the ability to remove default roles is still relevant and not addressed by the reasons given. Could you please take a look and assist?

<!-- gh-comment-id:4127069932 --> @dosubot[bot] commented on GitHub (Mar 25, 2026): @Bekacru The user joshsedl has pointed out that the issue was closed as not planned, but their concern about the ability to remove default roles is still relevant and not addressed by the reasons given. Could you please take a look and assist?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label organization
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19253
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?