github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #7490] [Admin] User has role #19454

New Issue
Open
opened 2026-04-15 18:33:56 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-15 18:33:56 -05:00
Owner
Copy Link

Originally created by @R5dan on GitHub (Jan 20, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/7490

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

I would like to be able to limit access to certain actions/pages etc based on the users role

Describe the solution you'd like

await auth.api.userHasRole({userId:string, role:string})

Describe alternatives you've considered

I have also considered adding a role permision to all of my roles, and then using

const data = await auth.api.userHasPermission({
    body: {
        userId: "user-id",
        permission: { "role": ["admin"] }
    },
});

But this doesn't feel like it should be necesary and I fear it would be easier to make a mistake in developing that leaves a scurity risk.

I have also considered having an access permission

const data = await auth.api.userHasPermission({
    body: {
        userId: "user-id",
        permission: { "access": ["page1"] }
    },
});

And I like this more, but am think this would get very busy very quickly

Additional context

I am happy to make add the feature. I am unsure whether userHasPermission already has this, due to a brief look at source code, but I don't believe it does. Access control is not very well documented (at least compared to the rest of the documentation)

Originally created by @R5dan on GitHub (Jan 20, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/7490 ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. I would like to be able to limit access to certain actions/pages etc based on the users role ### Describe the solution you'd like ```ts await auth.api.userHasRole({userId:string, role:string}) ``` ### Describe alternatives you've considered I have also considered adding a `role` permision to all of my roles, and then using ```ts const data = await auth.api.userHasPermission({ body: { userId: "user-id", permission: { "role": ["admin"] } }, }); ``` But this doesn't feel like it should be necesary and I fear it would be easier to make a mistake in developing that leaves a scurity risk. I have also considered having an `access` permission ```ts const data = await auth.api.userHasPermission({ body: { userId: "user-id", permission: { "access": ["page1"] } }, }); ``` And I like this more, but am think this would get very busy very quickly ### Additional context I am happy to make add the feature. I am unsure whether `userHasPermission` already has this, due to a brief look at source code, but I don't believe it does. Access control is not very well documented (at least compared to the rest of the documentation)
GiteaMirror added the organization label 2026-04-15 18:33:56 -05:00
GiteaMirror commented 2026-04-15 18:33:58 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 20, 2026):

To implement role-based access control in Better Auth, you can utilize the auth.api.userHasRole method. This method checks if a specific user has the required role(s) to access certain actions or pages. According to a recent feature update, userHasRole can handle both single and multiple roles and verifies authenticated sessions effectively [1].

You can also use the auth.api.userHasPermission method with a permissions object to check for specific access rights if needed, but do note that the documentation around access control might need more clarity [2].

Since you're considering various alternatives and seeking to optimize security while limiting complexity, using the userHasRole might simplify your implementation and reduce the potential for security risks. If you are happy to contribute this feature, it would be a good idea to track it or discuss with team members as necessary.

Considering your use case, do you think you'd prefer using roles primarily, or do you plan to implement more granular permission checks in the future? Let me know how I can assist you further!

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3771616520 --> @better-auth-agent[bot] commented on GitHub (Jan 20, 2026): To implement role-based access control in Better Auth, you can utilize the `auth.api.userHasRole` method. This method checks if a specific user has the required role(s) to access certain actions or pages. According to a recent feature update, `userHasRole` can handle both single and multiple roles and verifies authenticated sessions effectively [[1]](https://github.com/better-auth/better-auth/pull/6626). You can also use the `auth.api.userHasPermission` method with a permissions object to check for specific access rights if needed, but do note that the documentation around access control might need more clarity [[2]](https://github.com/better-auth/better-auth/pull/5679). Since you're considering various alternatives and seeking to optimize security while limiting complexity, using the `userHasRole` might simplify your implementation and reduce the potential for security risks. If you are happy to contribute this feature, it would be a good idea to track it or discuss with team members as necessary. Considering your use case, do you think you'd prefer using roles primarily, or do you plan to implement more granular permission checks in the future? Let me know how I can assist you further! _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-15 18:33:59 -05:00
Author
Owner
Copy Link

@chris23lngr commented on GitHub (Jan 24, 2026):

I have already opened a PR for this #6626 but there haven't been any updates in a while.

<!-- gh-comment-id:3794414909 --> @chris23lngr commented on GitHub (Jan 24, 2026): I have already opened a PR for this #6626 but there haven't been any updates in a while.
GiteaMirror commented 2026-04-15 18:34:00 -05:00
Author
Owner
Copy Link

@R5dan commented on GitHub (Jan 26, 2026):

@chris23lngr Yes, I saw, should I close this issue?

<!-- gh-comment-id:3798635388 --> @R5dan commented on GitHub (Jan 26, 2026): @chris23lngr Yes, I saw, should I close this issue?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label organization
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19454
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?