github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #9156] dash plugin insight incorrectly flags custom defaultRole as non-existent #19923

New Issue
Closed
opened 2026-04-15 19:17:45 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-15 19:17:45 -05:00
Owner
Copy Link

Originally created by @gatezh on GitHub (Apr 13, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/9156

Is this suited for github?

  • Yes, this is suited for github

Reproduction

  1. Configure the admin plugin with a custom defaultRole and matching custom roles:
admin({
  ac: defaultAc as AccessControl,
  defaultRole: "agent",
  roles: {
    customer: userAc,
    agent: userAc,
    admin: adminAc,
  },
})
  1. Configure the dash plugin from @better-auth/infra:
dash({ apiKey: env.BETTER_AUTH_API_KEY })
  1. Open the Better Auth Infrastructure dashboard
  2. Observe the insight/warning:

    The default role "agent" assigned to new users does not exist in the defined roles.

Current vs. Expected behavior

Current: The dashboard flags defaultRole: "agent" as not existing in the defined roles.

Expected: The dashboard should recognize "agent" as a valid role since it exists as a key in the custom roles map passed to the admin plugin. The server-side admin plugin itself does not raise any error — the role is correctly applied to new users at runtime.

One theory is that the insight checks defaultRole against the built-in defaultRoles (admin + user) rather than the custom roles object. The /dash/config endpoint does serialize the plugin options (including both defaultRole and the roles keys) via sanitizePluginOptions(), so the data needed for correct validation appears to be available — but since the dash plugin source is not public, we can't confirm where the check happens.

What version of Better Auth are you using?

1.6.2

System info

- `@better-auth/infra`: 0.2.0
- Runtime: Cloudflare Workers (Hono)
- Database: Cloudflare D1 (SQLite)

Which area(s) are affected? (Select all that apply)

Client, Backend

Auth config (if applicable)

import { betterAuth } from "better-auth";
import { admin } from "better-auth/plugins";
import { dash, sentinel } from "@better-auth/infra";
import { adminAc, defaultAc, userAc } from "better-auth/plugins/admin/access";
import type { AccessControl } from "better-auth/plugins/access";

export const auth = betterAuth({
  // ...
  plugins: [
    admin({
      ac: defaultAc as AccessControl,
      defaultRole: "agent",
      roles: {
        customer: userAc,
        agent: userAc,
        admin: adminAc,
      },
    }),
    dash({
      apiKey: env.BETTER_AUTH_API_KEY,
    }),
    sentinel({
      apiKey: env.BETTER_AUTH_API_KEY,
    }),
  ],
});

Additional context

Related issues:

  • #2128 — fix for defaultRole/adminRoles not applying user config
  • #6991 / #6997 — fix for custom role type inference
  • #6081 / #6097 — hasPermission silent false for unknown roles
Originally created by @gatezh on GitHub (Apr 13, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/9156 ### Is this suited for github? - [x] Yes, this is suited for github ### Reproduction 1. Configure the admin plugin with a custom `defaultRole` and matching custom `roles`: ```ts admin({ ac: defaultAc as AccessControl, defaultRole: "agent", roles: { customer: userAc, agent: userAc, admin: adminAc, }, }) ``` 2. Configure the `dash` plugin from `@better-auth/infra`: ```ts dash({ apiKey: env.BETTER_AUTH_API_KEY }) ``` 3. Open the Better Auth Infrastructure dashboard 4. Observe the insight/warning: > The default role "agent" assigned to new users does not exist in the defined roles. ### Current vs. Expected behavior **Current:** The dashboard flags `defaultRole: "agent"` as not existing in the defined roles. **Expected:** The dashboard should recognize `"agent"` as a valid role since it exists as a key in the custom `roles` map passed to the admin plugin. The server-side admin plugin itself does not raise any error — the role is correctly applied to new users at runtime. One theory is that the insight checks `defaultRole` against the built-in `defaultRoles` (`admin` + `user`) rather than the custom `roles` object. The `/dash/config` endpoint does serialize the plugin options (including both `defaultRole` and the `roles` keys) via `sanitizePluginOptions()`, so the data needed for correct validation appears to be available — but since the `dash` plugin source is not public, we can't confirm where the check happens. ### What version of Better Auth are you using? 1.6.2 ### System info ```bash - `@better-auth/infra`: 0.2.0 - Runtime: Cloudflare Workers (Hono) - Database: Cloudflare D1 (SQLite) ``` ### Which area(s) are affected? (Select all that apply) Client, Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth"; import { admin } from "better-auth/plugins"; import { dash, sentinel } from "@better-auth/infra"; import { adminAc, defaultAc, userAc } from "better-auth/plugins/admin/access"; import type { AccessControl } from "better-auth/plugins/access"; export const auth = betterAuth({ // ... plugins: [ admin({ ac: defaultAc as AccessControl, defaultRole: "agent", roles: { customer: userAc, agent: userAc, admin: adminAc, }, }), dash({ apiKey: env.BETTER_AUTH_API_KEY, }), sentinel({ apiKey: env.BETTER_AUTH_API_KEY, }), ], }); ``` ### Additional context Related issues: - #2128 — fix for `defaultRole`/`adminRoles` not applying user config - #6991 / #6997 — fix for custom role type inference - #6081 / #6097 — `hasPermission` silent false for unknown roles
GiteaMirror added the devtools label 2026-04-15 19:17:45 -05:00
GiteaMirror commented 2026-04-15 19:17:49 -05:00
Author
Owner
Copy Link

@jonathansamines commented on GitHub (Apr 13, 2026):

Hey @gatezh, we just released @better-auth/infra 0.2.2 with a fix for this. This was a serialization bug on our side. Please let us know how the new version works for you 🙏🏻 .

<!-- gh-comment-id:4239953967 --> @jonathansamines commented on GitHub (Apr 13, 2026): Hey @gatezh, we just released `@better-auth/infra` 0.2.2 with a fix for this. This was a serialization bug on our side. Please let us know how the new version works for you 🙏🏻 .
GiteaMirror commented 2026-04-15 19:17:51 -05:00
Author
Owner
Copy Link

@gatezh commented on GitHub (Apr 15, 2026):

Thanks a lot @jonathansamines – confirmed the fix, no warnings anymore

<!-- gh-comment-id:4254783265 --> @gatezh commented on GitHub (Apr 15, 2026): Thanks a lot @jonathansamines – confirmed the fix, no warnings anymore
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label devtools
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#19923
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?