github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7900] [CLOSED] fix: handle falsy filters, nullable invitation return, and oauth redirect key #24521

New Issue
Closed
opened 2026-04-15 22:24:37 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 22:24:37 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7900
Author: @jayy-77
Created: 2/10/2026
Status: ❌ Closed

Base: canary ← Head: fix/response-handling-edge-cases-7837-7824-7807

📝 Commits (1)

  • f274984 fix: handle falsy filters, nullable invitation return, and oauth redirect key

📊 Changes

5 files changed (+117 additions, -60 deletions)

View changed files

📝 packages/better-auth/src/plugins/admin/admin.test.ts (+59 -0)
📝 packages/better-auth/src/plugins/admin/routes.ts (+1 -1)
📝 packages/better-auth/src/plugins/organization/routes/crud-invites.ts (+30 -32)
📝 packages/oauth-provider/src/consent.ts (+24 -24)
📝 packages/oauth-provider/src/continue.ts (+3 -3)

📄 Description

Problem

Three related response-handling bugs across admin, organization, and oauth-provider plugins:

  1. Admin listUsers ignores falsy filter values (#7837) — The truthy check if (ctx.query?.filterValue) silently drops valid falsy values like false, 0, and "", making it impossible to filter by e.g. banned = false.

  2. acceptInvitation nullable return type (#7824) — A redundant guard returns ctx.json(null, ...) instead of throwing an APIError, polluting TypeScript's return type inference so consumers must handle null even though the code path is unreachable.

  3. /oauth2/continue and /oauth2/consent return uri instead of url (#7807) — The client-side redirect plugin checks context.data?.url but the server returns uri, breaking automatic client-side redirects after consent/continue flows.

Changes

  • packages/better-auth/src/plugins/admin/routes.ts: Changed if (ctx.query?.filterValue) to if (ctx.query?.filterValue !== undefined) so falsy values pass through to the query builder.
  • packages/better-auth/src/plugins/organization/routes/crud-invites.ts: Replaced ctx.json(null, { status: 400, ... }) with throw APIError.from("BAD_REQUEST", ...) for correct type narrowing.
  • packages/oauth-provider/src/continue.ts: Renamed uri property to url in all 3 response objects (selected, created, postLogin).
  • packages/oauth-provider/src/consent.ts: Renamed uri property to url in both response objects (denied + accepted consent).
  • packages/better-auth/src/plugins/admin/admin.test.ts: Added edge-case tests for boolean false, numeric 0, and default filterField fallback.

Test plan

  • npx vitest run packages/better-auth/src/plugins/admin/admin.test.ts — 71/71 tests pass
  • npx tsc --noEmit in packages/better-auth — clean
  • npx tsc --noEmit in packages/oauth-provider — clean

Fixes #7837, fixes #7824, fixes #7807

Summary by cubic

Fixes three response-handling edge cases across admin, organization, and OAuth plugins: falsy filters are honored, acceptInvitation no longer returns null, and OAuth endpoints return url for redirects. Fixes #7837, #7824, #7807.

  • Bug Fixes
    • Admin listUsers: treat filterValue as present when !== undefined, enabling false/0/"" filters.
    • Organization acceptInvitation: throw BAD_REQUEST instead of returning null to keep return type non-null.
    • OAuth continue/consent: use url (not uri) in responses so client redirects work.

Written for commit f2749849ef. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7900 **Author:** [@jayy-77](https://github.com/jayy-77) **Created:** 2/10/2026 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `fix/response-handling-edge-cases-7837-7824-7807` --- ### 📝 Commits (1) - [`f274984`](https://github.com/better-auth/better-auth/commit/f2749849ef7b9b2237ef7ba63c131d312abe33ac) fix: handle falsy filters, nullable invitation return, and oauth redirect key ### 📊 Changes **5 files changed** (+117 additions, -60 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/admin/admin.test.ts` (+59 -0) 📝 `packages/better-auth/src/plugins/admin/routes.ts` (+1 -1) 📝 `packages/better-auth/src/plugins/organization/routes/crud-invites.ts` (+30 -32) 📝 `packages/oauth-provider/src/consent.ts` (+24 -24) 📝 `packages/oauth-provider/src/continue.ts` (+3 -3) </details> ### 📄 Description ## Problem Three related response-handling bugs across admin, organization, and oauth-provider plugins: 1. **Admin `listUsers` ignores falsy filter values (#7837)** — The truthy check `if (ctx.query?.filterValue)` silently drops valid falsy values like `false`, `0`, and `""`, making it impossible to filter by e.g. `banned = false`. 2. **`acceptInvitation` nullable return type (#7824)** — A redundant guard returns `ctx.json(null, ...)` instead of throwing an `APIError`, polluting TypeScript's return type inference so consumers must handle `null` even though the code path is unreachable. 3. **`/oauth2/continue` and `/oauth2/consent` return `uri` instead of `url` (#7807)** — The client-side redirect plugin checks `context.data?.url` but the server returns `uri`, breaking automatic client-side redirects after consent/continue flows. ## Changes - **`packages/better-auth/src/plugins/admin/routes.ts`**: Changed `if (ctx.query?.filterValue)` to `if (ctx.query?.filterValue !== undefined)` so falsy values pass through to the query builder. - **`packages/better-auth/src/plugins/organization/routes/crud-invites.ts`**: Replaced `ctx.json(null, { status: 400, ... })` with `throw APIError.from("BAD_REQUEST", ...)` for correct type narrowing. - **`packages/oauth-provider/src/continue.ts`**: Renamed `uri` property to `url` in all 3 response objects (`selected`, `created`, `postLogin`). - **`packages/oauth-provider/src/consent.ts`**: Renamed `uri` property to `url` in both response objects (denied + accepted consent). - **`packages/better-auth/src/plugins/admin/admin.test.ts`**: Added edge-case tests for boolean `false`, numeric `0`, and default `filterField` fallback. ## Test plan - `npx vitest run packages/better-auth/src/plugins/admin/admin.test.ts` — 71/71 tests pass - `npx tsc --noEmit` in `packages/better-auth` — clean - `npx tsc --noEmit` in `packages/oauth-provider` — clean Fixes #7837, fixes #7824, fixes #7807 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Fixes three response-handling edge cases across admin, organization, and OAuth plugins: falsy filters are honored, acceptInvitation no longer returns null, and OAuth endpoints return url for redirects. Fixes #7837, #7824, #7807. - **Bug Fixes** - Admin listUsers: treat filterValue as present when !== undefined, enabling false/0/"" filters. - Organization acceptInvitation: throw BAD_REQUEST instead of returning null to keep return type non-null. - OAuth continue/consent: use url (not uri) in responses so client redirects work. <sup>Written for commit f2749849ef7b9b2237ef7ba63c131d312abe33ac. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 22:24:37 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#24521
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?