github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #40] Organization support for multiple roles and policies #25425

New Issue
Closed
opened 2026-04-17 15:37:34 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-17 15:37:34 -05:00
Owner
Copy Link

Originally created by @Giggiux on GitHub (Sep 29, 2024).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/40

Hi,

Having three sets of roles for the organization plugins (owner, admin, member) is helpful in many use cases, but integrating better-auth with complex APIs could require having different roles and sets of permissions for each role.

In my projects, I have at least a couple of examples where the domain I worked on required at least 4-5 different "sets of permissions" grouped in roles.

There are many Authentication libraries out there, either SaaS or open source. This one has me hyped the most because it offers tons of ready-made and simple-to-use options.
The only issue that I've found mostly ignored by all the authentication libraries is authorization. Some of them make compromises, and others simply don't give it to you.

Better-auth seems to be on the right path of being the "all in one" Auth \^2  library, so I suggest trying to implement the best authorization library I believe there could be.

Having roles in code is pretty straightforward and an excellent option, and as far as I can understand from the docs, the permissions are a CRUD "resource-based" system. It would also be nice to have permissions at the attribute (read column) level, other than the resource (read row) level, but that can be relatively more complex than the library's scope. And will probably fall into not just "authentication," but more like the "authentication."

So, as of now, I would like, if possible, to suggest two edits that are very interconnected with each other:

  1. Change the way the roles are defined to be customizable by the user
  2. Add some examples of using the custom permissions system after the setup.

For "2." Maybe I've lost some concepts reading the docs, but I don't understand how, after adding a new "project" resource permission, I can link it to an actual API endpoint or backend endpoint, etc...

Also, for the future, getting back to the authentication part, it would be cool to look at the Directus policy-based access control system and how it is integrated with roles.

Originally created by @Giggiux on GitHub (Sep 29, 2024). Original GitHub issue: https://github.com/better-auth/better-auth/issues/40 Hi, Having three sets of roles for the organization plugins (owner, admin, member) is helpful in many use cases, but integrating better-auth with complex APIs could require having different roles and sets of permissions for each role. In my projects, I have at least a couple of examples where the domain I worked on required at least 4-5 different "sets of permissions" grouped in roles. There are many Authentication libraries out there, either SaaS or open source. This one has me hyped the most because it offers tons of ready-made and simple-to-use options. The only issue that I've found mostly ignored by all the authentication libraries is authorization. Some of them make compromises, and others simply don't give it to you. Better-auth seems to be on the right path of being the "all in one" Auth $\^2$  library, so I suggest trying to implement the best authorization library I believe there could be. Having roles in code is pretty straightforward and an excellent option, and as far as I can understand from the docs, the permissions are a CRUD "resource-based" system. It would also be nice to have permissions at the attribute (read column) level, other than the resource (read row) level, but that can be relatively more complex than the library's scope. And will probably fall into not just "authentication," but more like the "authentication." So, as of now, I would like, if possible, to suggest two edits that are very interconnected with each other: 1. Change the way the roles are defined to be customizable by the user 2. Add some examples of using the custom permissions system after the setup. For "2." Maybe I've lost some concepts reading the docs, but I don't understand how, after adding a new "project" resource permission, I can link it to an actual API endpoint or backend endpoint, etc... Also, for the future, getting back to the authentication part, it would be cool to look at [the Directus policy-based access control](https://docs.directus.io/blog/understanding-policy-based-access-control.html) system and how it is integrated with roles.
GiteaMirror added the lockedenhancement labels 2026-04-17 15:37:34 -05:00
GiteaMirror commented 2026-04-17 15:37:37 -05:00
Author
Owner
Copy Link

@anishshobithps commented on GitHub (Oct 16, 2024):

Just to add this here, do you think https://github.com/stalniy/casl might be a good integration here as well ?

<!-- gh-comment-id:2415792246 --> @anishshobithps commented on GitHub (Oct 16, 2024): Just to add this here, do you think https://github.com/stalniy/casl might be a good integration here as well ?
GiteaMirror commented 2026-04-17 15:37:38 -05:00
Author
Owner
Copy Link

@GregorWedlich commented on GitHub (Oct 16, 2024):

I'm absolutely with you, Better-Auth could become the best authentication library in the future. For me, it would be if I could create custom roles and restrict routing with them.

<!-- gh-comment-id:2417330605 --> @GregorWedlich commented on GitHub (Oct 16, 2024): I'm absolutely with you, Better-Auth could become the best authentication library in the future. For me, it would be if I could create custom roles and restrict routing with them.
GiteaMirror commented 2026-04-17 15:37:39 -05:00
Author
Owner
Copy Link

@purefun commented on GitHub (Oct 29, 2024):

https://github.com/casbin/casbin is another great authorization library.

<!-- gh-comment-id:2442967414 --> @purefun commented on GitHub (Oct 29, 2024): https://github.com/casbin/casbin is another great authorization library.
GiteaMirror commented 2026-04-17 15:37:40 -05:00
Author
Owner
Copy Link

@vKongv commented on GitHub (Nov 8, 2024):

This is probably one of the most important feature for SaaS application. Just curious, what's the idea/solution in mind on implementing this? This is so we can expect our use case could fit with the implementation.

cc @Bekacru

<!-- gh-comment-id:2464137502 --> @vKongv commented on GitHub (Nov 8, 2024): This is probably one of the most important feature for SaaS application. Just curious, what's the idea/solution in mind on implementing this? This is so we can expect our use case could fit with the implementation. cc @Bekacru
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#25425
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?