github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7485] [MERGED] v1.4.16 #24249

New Issue
Closed
opened 2026-04-15 22:15:35 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:15:35 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7485
Author: @himself65
Created: 1/20/2026
Status: ✅ Merged
Merged: 1/20/2026
Merged by: @himself65

Base: main ← Head: v1.4.16-staging

📝 Commits (10+)

  • bc9fe98 feat(admin): make password field optional on create user (#7441)
  • 9d950aa chore: fix opencode tag and MCP command structure (#7451)
  • 4200ec9 fix(organization): missing activeTeamId field when dynamic access control is enabled (#7385)
  • 1c8c220 docs(JWT): moved incorrect documentation (#7456)
  • 7b7f3c8 docs: add "10 Better Auth plugins that just save so much time" resource (#7455)
  • 266e9ea chore(demo): correct trustedProviders option (#7449)
  • 863b564 docs: use tabs on drizzle-kit scripts (#7469)
  • 687882b chore: remove type casting for provider id (#7468)
  • 08afa10 fix(oauth): set account cookie on re-login when updateAccountOnSignIn is false (#7217)
  • feb2084 refactor: return linked account in findOAuthUser (#7331)

📊 Changes

28 files changed (+1574 additions, -538 deletions)

View changed files

📝 demo/nextjs/lib/auth.ts (+12 -1)
📝 docs/content/docs/adapters/drizzle.mdx (+12 -4)
📝 docs/content/docs/concepts/rate-limit.mdx (+39 -1)
📝 docs/content/docs/plugins/jwt.mdx (+16 -14)
📝 docs/content/docs/reference/resources.mdx (+6 -0)
➕ e2e/smoke/test/fixtures/ipv6/index.ts (+46 -0)
➕ e2e/smoke/test/fixtures/ipv6/package.json (+10 -0)
➕ e2e/smoke/test/fixtures/ipv6/tsconfig.json (+10 -0)
➕ e2e/smoke/test/ipv6.spec.ts (+205 -0)
📝 packages/better-auth/src/api/rate-limiter/index.ts (+2 -2)
📝 packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts (+175 -92)
📝 packages/better-auth/src/api/routes/account.test.ts (+105 -0)
📝 packages/better-auth/src/api/routes/callback.ts (+1 -3)
📝 packages/better-auth/src/db/internal-adapter.ts (+20 -15)
📝 packages/better-auth/src/oauth2/link-account.ts (+37 -30)
📝 packages/better-auth/src/plugins/admin/admin.test.ts (+33 -0)
📝 packages/better-auth/src/plugins/admin/routes.ts (+16 -10)
📝 packages/better-auth/src/plugins/organization/organization.test.ts (+37 -0)
📝 packages/better-auth/src/plugins/organization/schema.ts (+59 -58)
📝 packages/better-auth/src/utils/get-request-ip.ts (+4 -17)

...and 8 more files

📄 Description

Summary by cubic

Adds passwordless user creation for admins, improves OAuth account linking and cookies, and adds IPv6-aware rate limiting with subnet support. Also fixes activeTeamId in sessions when organizations and teams are enabled, updates demo trusted providers, and updates the MCP CLI.

  • New Features

    • Admin: create users without a password; no credential account is created if omitted.
    • Rate limit: normalize IPv6, convert IPv4-mapped IPv6, and support subnet-based limiting (configurable ipv6Subnet).
    • Organization: adds activeTeamId to session when dynamicAccessControl and teams are both enabled.
    • CLI (MCP): supports the "opencode" alias and uses local command format.
    • Demo: updates accountLinking trustedProviders with common providers.

  • Bug Fixes

    • OAuth: sets the account cookie on re-login even when updateAccountOnSignIn is false.
    • Account linking: returns the linkedAccount from findOAuthUser and updates cookie/tokens correctly; removes provider id type casting.
    • Docs: corrects JWT OAuth provider mode placement, adds IPv6 rate limit guidance, and improves drizzle migration steps with tabs; adds a new resource link.

Written for commit ae0e280587. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7485 **Author:** [@himself65](https://github.com/himself65) **Created:** 1/20/2026 **Status:** ✅ Merged **Merged:** 1/20/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `main` ← **Head:** `v1.4.16-staging` --- ### 📝 Commits (10+) - [`bc9fe98`](https://github.com/better-auth/better-auth/commit/bc9fe98bd041a9cebd86056eae325cf2eceffb2b) feat(admin): make password field optional on create user (#7441) - [`9d950aa`](https://github.com/better-auth/better-auth/commit/9d950aaade36b3c1fa3548f6ce7e0425a0226560) chore: fix opencode tag and MCP command structure (#7451) - [`4200ec9`](https://github.com/better-auth/better-auth/commit/4200ec9f7329bc0ed4391b0ad248dc8d60cb87a7) fix(organization): missing `activeTeamId` field when dynamic access control is enabled (#7385) - [`1c8c220`](https://github.com/better-auth/better-auth/commit/1c8c2207f8c9585024e5df856a2c5b4261495d32) docs(JWT): moved incorrect documentation (#7456) - [`7b7f3c8`](https://github.com/better-auth/better-auth/commit/7b7f3c8b0d7f10ae2ba7c2d7d1135e70c096b6ab) docs: add "10 Better Auth plugins that just save so much time" resource (#7455) - [`266e9ea`](https://github.com/better-auth/better-auth/commit/266e9eadb299cff1785df1e9c34f96662f7df7d6) chore(demo): correct trustedProviders option (#7449) - [`863b564`](https://github.com/better-auth/better-auth/commit/863b5648b14b0923aeeb714dd94eb0ed682f3b59) docs: use tabs on drizzle-kit scripts (#7469) - [`687882b`](https://github.com/better-auth/better-auth/commit/687882bdd870c95dacab3478f6fdce299759014b) chore: remove type casting for provider id (#7468) - [`08afa10`](https://github.com/better-auth/better-auth/commit/08afa103370681a11f641d6c11158e5d3abd2809) fix(oauth): set account cookie on re-login when `updateAccountOnSignIn` is false (#7217) - [`feb2084`](https://github.com/better-auth/better-auth/commit/feb2084f58f38f4aecc76319ac0aa7cfa86eabb0) refactor: return linked account in findOAuthUser (#7331) ### 📊 Changes **28 files changed** (+1574 additions, -538 deletions) <details> <summary>View changed files</summary> 📝 `demo/nextjs/lib/auth.ts` (+12 -1) 📝 `docs/content/docs/adapters/drizzle.mdx` (+12 -4) 📝 `docs/content/docs/concepts/rate-limit.mdx` (+39 -1) 📝 `docs/content/docs/plugins/jwt.mdx` (+16 -14) 📝 `docs/content/docs/reference/resources.mdx` (+6 -0) ➕ `e2e/smoke/test/fixtures/ipv6/index.ts` (+46 -0) ➕ `e2e/smoke/test/fixtures/ipv6/package.json` (+10 -0) ➕ `e2e/smoke/test/fixtures/ipv6/tsconfig.json` (+10 -0) ➕ `e2e/smoke/test/ipv6.spec.ts` (+205 -0) 📝 `packages/better-auth/src/api/rate-limiter/index.ts` (+2 -2) 📝 `packages/better-auth/src/api/rate-limiter/rate-limiter.test.ts` (+175 -92) 📝 `packages/better-auth/src/api/routes/account.test.ts` (+105 -0) 📝 `packages/better-auth/src/api/routes/callback.ts` (+1 -3) 📝 `packages/better-auth/src/db/internal-adapter.ts` (+20 -15) 📝 `packages/better-auth/src/oauth2/link-account.ts` (+37 -30) 📝 `packages/better-auth/src/plugins/admin/admin.test.ts` (+33 -0) 📝 `packages/better-auth/src/plugins/admin/routes.ts` (+16 -10) 📝 `packages/better-auth/src/plugins/organization/organization.test.ts` (+37 -0) 📝 `packages/better-auth/src/plugins/organization/schema.ts` (+59 -58) 📝 `packages/better-auth/src/utils/get-request-ip.ts` (+4 -17) _...and 8 more files_ </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Adds passwordless user creation for admins, improves OAuth account linking and cookies, and adds IPv6-aware rate limiting with subnet support. Also fixes activeTeamId in sessions when organizations and teams are enabled, updates demo trusted providers, and updates the MCP CLI. - **New Features** - Admin: create users without a password; no credential account is created if omitted. - Rate limit: normalize IPv6, convert IPv4-mapped IPv6, and support subnet-based limiting (configurable ipv6Subnet). - Organization: adds activeTeamId to session when dynamicAccessControl and teams are both enabled. - CLI (MCP): supports the "opencode" alias and uses local command format. - Demo: updates accountLinking trustedProviders with common providers. - **Bug Fixes** - OAuth: sets the account cookie on re-login even when updateAccountOnSignIn is false. - Account linking: returns the linkedAccount from findOAuthUser and updates cookie/tokens correctly; removes provider id type casting. - Docs: corrects JWT OAuth provider mode placement, adds IPv6 rate limit guidance, and improves drizzle migration steps with tabs; adds a new resource link. <sup>Written for commit ae0e280587cb810f53858e686cc0d69e4e129b2c. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:15:35 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#24249
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?