github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 06:16:18 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

ListUsers endpoint returns incorrect role #2696

New Issue
Closed
opened 2026-03-13 10:13:46 -05:00 by GiteaMirror · 5 comments
GiteaMirror commented 2026-03-13 10:13:46 -05:00
Owner
Copy Link

Originally created by @juzhiyuan on GitHub (Jan 13, 2026).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Enable apikey plugin and admin plugin, set the specific userid in the adminUserIds parameter, and enable enableSessionForAPIKeys=true.
Image
  1. Access the /list-users endpoint, and its role is user rather than admin
Image

Current vs. Expected behavior

  1. Current: /list-users endpoint returns the role=user object.
  2. Expected behaviour: it should return role=admin object.

What version of Better Auth are you using?

^1.4.10

System info

{
  "system": {
    "platform": "darwin",
    "arch": "arm64",
    "version": "Darwin Kernel Version 25.1.0: Mon Oct 20 19:34:05 PDT 2025; root:xnu-12377.41.6~2/RELEASE_ARM64_T6041",
    "release": "25.1.0",
    "cpuCount": 14,
    "cpuModel": "Apple M4 Pro",
    "totalMemory": "48.00 GB",
    "freeMemory": "3.41 GB"
  },
  "node": {
    "version": "v24.12.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "11.6.2"
  },
  "frameworks": null,
  "databases": null,
  "betterAuth": {
    "version": "Unknown",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

export const auth = betterAuth({
  appName: config.app.name,
  baseURL: config.app.baseURL,
  trustedOrigins: config.app.trustedOrigins,
  basePath: AUTH_BASE_PATH,
  database: drizzleAdapter(db, {
    provider: 'pg',
  }),
  emailAndPassword: config.auth.emailAndPassword,
  session: {
    expiresIn: config.auth.session.expiresIn,
    updateAge: config.auth.session.updateAge,
  },
  secret: config.auth.secret,
  socialProviders: config.auth.socialProviders,
  plugins: [admin({
    adminUserIds: ["i9jNSsdRjbsLa8zrwirrb4WvmLquwQJq"]
  }), apiKey({
    enableSessionForAPIKeys: true,
    rateLimit: {
      enabled: false
    }
  }), bearer(), nextCookies(), organization(), openAPI(), ...getTestingConfig()],
});

Additional context

No response

Originally created by @juzhiyuan on GitHub (Jan 13, 2026). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Enable `apikey` plugin and `admin` plugin, set the specific userid in the `adminUserIds` parameter, and enable `enableSessionForAPIKeys=true`. <img width="1117" height="479" alt="Image" src="https://github.com/user-attachments/assets/4932120e-2bd4-4203-b64a-34cf0f6aba7f" /> 2. Access the `/list-users` endpoint, and its role is `user` rather than `admin` <img width="1306" height="922" alt="Image" src="https://github.com/user-attachments/assets/1d73f343-0782-4bb6-831d-10db48a2b5eb" /> ### Current vs. Expected behavior 1. Current: `/list-users` endpoint returns the `role=user` object. 2. Expected behaviour: it should return `role=admin` object. ### What version of Better Auth are you using? ^1.4.10 ### System info ```bash { "system": { "platform": "darwin", "arch": "arm64", "version": "Darwin Kernel Version 25.1.0: Mon Oct 20 19:34:05 PDT 2025; root:xnu-12377.41.6~2/RELEASE_ARM64_T6041", "release": "25.1.0", "cpuCount": 14, "cpuModel": "Apple M4 Pro", "totalMemory": "48.00 GB", "freeMemory": "3.41 GB" }, "node": { "version": "v24.12.0", "env": "development" }, "packageManager": { "name": "npm", "version": "11.6.2" }, "frameworks": null, "databases": null, "betterAuth": { "version": "Unknown", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript export const auth = betterAuth({ appName: config.app.name, baseURL: config.app.baseURL, trustedOrigins: config.app.trustedOrigins, basePath: AUTH_BASE_PATH, database: drizzleAdapter(db, { provider: 'pg', }), emailAndPassword: config.auth.emailAndPassword, session: { expiresIn: config.auth.session.expiresIn, updateAge: config.auth.session.updateAge, }, secret: config.auth.secret, socialProviders: config.auth.socialProviders, plugins: [admin({ adminUserIds: ["i9jNSsdRjbsLa8zrwirrb4WvmLquwQJq"] }), apiKey({ enableSessionForAPIKeys: true, rateLimit: { enabled: false } }), bearer(), nextCookies(), organization(), openAPI(), ...getTestingConfig()], }); ``` ### Additional context _No response_
GiteaMirror added the bug label 2026-03-13 10:13:46 -05:00
GiteaMirror commented 2026-03-13 10:13:48 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 13, 2026):

It looks like you're experiencing an issue where the /list-users endpoint is returning a role of user instead of admin. Based on the documentation and the existing issues related to the plugin settings, this could potentially be linked to how the roles are defined and returned from the API.

To troubleshoot this issue, please ensure that the following steps are correctly implemented:

  1. Confirm that the adminUserIds parameter is accurately set with the correct user ID(s) that should have admin privileges.
  2. Double-check that both the apikey and admin plugins are enabled as expected.
  3. Verify that there's no conflicting configuration elsewhere in your auth setup that would override this behavior.
  4. Review any existing issues about the listUsers endpoint for similar problems, as there have been past discussions regarding incorrect role returns with the admin plugin [1].

If everything seems correct but the issue persists, I suggest tagging @bekacru or @ping__ for further assistance, as they are more suited to address these specifics.

Is there anything else you'd like to explore regarding Better Auth or any other specific features you're working with?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Jan 13, 2026): It looks like you're experiencing an issue where the `/list-users` endpoint is returning a role of `user` instead of `admin`. Based on the documentation and the existing issues related to the plugin settings, this could potentially be linked to how the roles are defined and returned from the API. To troubleshoot this issue, please ensure that the following steps are correctly implemented: 1. Confirm that the `adminUserIds` parameter is accurately set with the correct user ID(s) that should have admin privileges. 2. Double-check that both the `apikey` and `admin` plugins are enabled as expected. 3. Verify that there's no conflicting configuration elsewhere in your auth setup that would override this behavior. 4. Review any existing issues about the `listUsers` endpoint for similar problems, as there have been past discussions regarding incorrect role returns with the admin plugin [[1]](https://github.com/better-auth/better-auth/issues/2588). If everything seems correct but the issue persists, I suggest tagging @bekacru or @ping__ for further assistance, as they are more suited to address these specifics. Is there anything else you'd like to explore regarding Better Auth or any other specific features you're working with? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) • [Discord](https://discord.gg/fG2XXEuQX3) • [GitHub](https://github.com/Skyvern-AI/Skyvern) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/skyvern_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/fG2XXEuQX3) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/Skyvern-AI/Skyvern)
GiteaMirror commented 2026-03-13 10:13:48 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Jan 13, 2026):

This is expected behavior in Better Auth. The /list-users endpoint returns each user's role as stored in the database, not as inferred from adminUserIds or session context. Listing a user ID in adminUserIds grants that user admin permissions for access control, but does not change their role field in the returned data. If you want the role to show as admin, you need to update the user's role in the database to admin—for example, using the admin.setRole endpoint or a direct DB update. Being in adminUserIds only affects permission checks, not the role value in API responses.
Source: apiKey plugin code
Source: admin plugin code

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Jan 13, 2026): <!-- Answer --> This is expected behavior in Better Auth. The `/list-users` endpoint returns each user's role as stored in the database, not as inferred from `adminUserIds` or session context. Listing a user ID in `adminUserIds` grants that user admin permissions for access control, but does not change their `role` field in the returned data. If you want the role to show as `admin`, you need to update the user's role in the database to `admin`—for example, using the `admin.setRole` endpoint or a direct DB update. Being in `adminUserIds` only affects permission checks, not the role value in API responses. [Source: apiKey plugin code](https://github.com/better-auth/better-auth/blob/f93127283846033855fcc94951bcb201a2a28c2e/packages/better-auth/src/plugins/api-key/index.ts#L62-L345) [Source: admin plugin code](https://github.com/better-auth/better-auth/blob/f93127283846033855fcc94951bcb201a2a28c2e/packages/better-auth/src/plugins/admin/routes.ts#L28-L681) <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/80b7fef0-7922-4108-a51a-4379ab297f9a?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/80b7fef0-7922-4108-a51a-4379ab297f9a?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/80b7fef0-7922-4108-a51a-4379ab297f9a?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/80b7fef0-7922-4108-a51a-4379ab297f9a?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/80b7fef0-7922-4108-a51a-4379ab297f9a?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/80b7fef0-7922-4108-a51a-4379ab297f9a?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/80b7fef0-7922-4108-a51a-4379ab297f9a?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20is%20expected%20behavior%20in%20Better%20Auth.%20The%20%60/list-users%60%20endpoint%20returns%20each%20user%27s%20role%20as%20stored%20in%20the%20database%2C%20not%20as%20inferred%20from%20%60adminUserIds%60%20or%20session%20context.%20Listing%20a%20user%20ID%20in%20%60adminUserIds%60%20grants%20that%20user%20admin%20permissions%20for%20access%20control%2C%20but%20does%20not%20change%20their%20%60role%60%20field%20in%20the%20returned%20data.%20If%20you%20want%20the%20role%20to%20show%20as%20%60admin%60%2C%20you%20need%20to%20update%20the%20user%27s%20role%20in%20the%20database%20to%20%60admin%60%E2%80%94for%20example%2C%20using%20the%20%60admin.setRole%60%20endpoint%20or%20a%20direct%20DB%20update.%20Being%20in%20%60adminUserIds%60%20only%20affects%20permission%20checks%2C%20not%20the%20role%20value%20in%20API%20responses.%20%20%0A%5BSource%3A%20apiKey%20plugin%20code%5D%28https%3A//github.com/better-auth/better-auth/blob/f93127283846033855fcc94951bcb201a2a28c2e/packages/better-auth/src/plugins/api-key/index.ts%23L62-L345%29%20%20%0A%5BSource%3A%20admin%20plugin%20code%5D%28https%3A//github.com/better-auth/better-auth/blob/f93127283846033855fcc94951bcb201a2a28c2e/packages/better-auth/src/plugins/admin/routes.ts%23L28-L681%29)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/7312)
GiteaMirror commented 2026-03-13 10:13:49 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Jan 13, 2026):

Session created by api keys are mocks...we generally reocmmend to avoid using session for api keys

@Bekacru commented on GitHub (Jan 13, 2026): Session created by api keys are mocks...we generally reocmmend to avoid using session for api keys
GiteaMirror commented 2026-03-13 10:13:49 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Jan 27, 2026):

Tip

Before performing any admin operations, the user must be authenticated with an admin account. An admin is any user assigned the admin role or any user whose ID is included in the adminUserIds option.

-> https://www.better-auth.com/docs/plugins/admin#usage

Hi @juzhiyuan,

There are two ways to become an admin user.

The usual way is setting the role in the database through authClient.admin.setRole().

You can also include your ID in adminUserIds, which acts like a superuser. Users in adminUserIds bypass admin permissions regardless of their role in the database.

@bytaesu commented on GitHub (Jan 27, 2026): > [!TIP] > Before performing any admin operations, the user must be authenticated with an admin account. An admin is any user assigned the admin role or any user whose ID is included in the adminUserIds option. > > -> https://www.better-auth.com/docs/plugins/admin#usage Hi @juzhiyuan, There are two ways to become an admin user. The usual way is setting the role in the database through `authClient.admin.setRole()`. You can also include your ID in adminUserIds, which acts like a superuser. Users in adminUserIds bypass admin permissions regardless of their role in the database.
GiteaMirror commented 2026-03-13 10:13:50 -05:00
Author
Owner
Copy Link

@bytaesu commented on GitHub (Jan 27, 2026):

I'm closing this as it's not an actual issue.
Feel free to mention me if you have any further questions 🙂

@bytaesu commented on GitHub (Jan 27, 2026): I'm closing this as it's not an actual issue. Feel free to mention me if you have any further questions 🙂
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2696
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?