github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8042] onPasswordReset callback not called in phone-number reset password route #19609

New Issue
Closed
opened 2026-04-15 18:53:07 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 18:53:07 -05:00
Owner
Copy Link

Originally created by @DibyodyutiMondal on GitHub (Feb 18, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8042

Description

The emailAndPassword.onPasswordReset callback is not invoked when a user resets their password via the phone-number OTP plugin (POST /phone-number/reset-password).

The other two password reset paths both call onPasswordReset consistently:

Reset path Calls onPasswordReset?
Reset by link (POST /reset-password) ✅ Yes
Email OTP (POST /email-otp/reset-password) ✅ Yes
Phone number OTP (POST /phone-number/reset-password) ❌ No

Affected File

packages/better-auth/src/plugins/phone-number/routes.ts, resetPasswordPhoneNumber handler (around line 839).

Current Behavior

After updating the password and deleting the verification value, the phone-number route skips onPasswordReset entirely — even though it does respect
revokeSessionsOnPasswordReset (the sibling option):

await ctx.context.internalAdapter.updatePassword(user.id, hashedPassword);
await ctx.context.internalAdapter.deleteVerificationValue(verification.id);

// ❌ onPasswordReset is never called here

if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) {
  await ctx.context.internalAdapter.deleteSessions(user.id);
}

Expected Behavior

onPasswordReset should be called after the password is updated, matching the pattern used in the other two paths:

  if (ctx.context.options.emailAndPassword?.onPasswordReset) {
    await ctx.context.options.emailAndPassword.onPasswordReset(
      { user },
      ctx.request,
    );
  }

Reference Implementations

  • Reset by link: packages/better-auth/src/api/routes/password.ts lines 313–322
  • Email OTP: packages/better-auth/src/plugins/email-otp/routes.ts lines 1040–1047
Originally created by @DibyodyutiMondal on GitHub (Feb 18, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8042 ### Description The `emailAndPassword.onPasswordReset` callback is not invoked when a user resets their password via the **phone-number OTP** plugin (`POST /phone-number/reset-password`). The other two password reset paths both call `onPasswordReset` consistently: | Reset path | Calls `onPasswordReset`? | |---|---| | Reset by link (`POST /reset-password`) | ✅ Yes | | Email OTP (`POST /email-otp/reset-password`) | ✅ Yes | | Phone number OTP (`POST /phone-number/reset-password`) | ❌ **No** | ### Affected File `packages/better-auth/src/plugins/phone-number/routes.ts`, `resetPasswordPhoneNumber` handler (around line 839). ### Current Behavior After updating the password and deleting the verification value, the phone-number route skips `onPasswordReset` entirely — even though it does respect `revokeSessionsOnPasswordReset` (the sibling option): ```ts await ctx.context.internalAdapter.updatePassword(user.id, hashedPassword); await ctx.context.internalAdapter.deleteVerificationValue(verification.id); // ❌ onPasswordReset is never called here if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) { await ctx.context.internalAdapter.deleteSessions(user.id); } ``` Expected Behavior onPasswordReset should be called after the password is updated, matching the pattern used in the other two paths: ```ts if (ctx.context.options.emailAndPassword?.onPasswordReset) { await ctx.context.options.emailAndPassword.onPasswordReset( { user }, ctx.request, ); } ``` Reference Implementations - Reset by link: packages/better-auth/src/api/routes/password.ts lines 313–322 - Email OTP: packages/better-auth/src/plugins/email-otp/routes.ts lines 1040–1047
GiteaMirror added the lockedbug labels 2026-04-15 18:53:07 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19609
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?