github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-09-01 02:55:08 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #5093] Organization update allows using a slug twice #27484

New Issue
Closed
opened 2026-04-17 18:32:05 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-17 18:32:05 -05:00
Owner
Copy Link
Copy Source

Originally created by @JE4GLE on GitHub (Oct 5, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/5093

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Setup organizations plugin
  2. Create an organization with slug a
  3. Create an organization with slug b
  4. Update organization b and change the slug to a
  5. Both organizations now have the slug a

Current vs. Expected behavior

Current behavior: The slug is changed
Expected behavior: An error message is shown when the slug is already taken by another organization

What version of Better Auth are you using?

1.3.26

System info

npx @better-auth/cli info --json
Need to install the following packages:
@better-auth/cli@1.3.26
Ok to proceed? (y) y

Exit code 1

Which area(s) are affected? (Select all that apply)

Backend, Client, Package

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  plugins: [
    organization({
      allowUserToCreateOrganization: (user) => user.emailVerified,
      requireEmailVerificationOnAcceptInvitation: true,
      organizationLimit: 3,
    })
  ]
});

Additional context

Code used to update the slug:

const { data: result, error } = await authClient.organization.update({
				data: {
					name,
					slug,
					logo: imageUrl
				},
				organizationId: organizationId
			});
Originally created by @JE4GLE on GitHub (Oct 5, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/5093 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Setup organizations plugin 2. Create an organization with slug `a` 3. Create an organization with slug `b` 4. Update organization `b` and change the slug to `a` 5. Both organizations now have the slug `a` ### Current vs. Expected behavior **Current behavior:** The slug is changed **Expected behavior:** An error message is shown when the slug is already taken by another organization ### What version of Better Auth are you using? 1.3.26 ### System info ```bash npx @better-auth/cli info --json Need to install the following packages: @better-auth/cli@1.3.26 Ok to proceed? (y) y Exit code 1 ``` ### Which area(s) are affected? (Select all that apply) Backend, Client, Package ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ plugins: [ organization({ allowUserToCreateOrganization: (user) => user.emailVerified, requireEmailVerificationOnAcceptInvitation: true, organizationLimit: 3, }) ] }); ``` ### Additional context Code used to update the slug: ```typescript const { data: result, error } = await authClient.organization.update({ data: { name, slug, logo: imageUrl }, organizationId: organizationId }); ```
GiteaMirror added the lockedbug labels 2026-04-17 18:32:06 -05:00
GiteaMirror commented 2026-04-17 18:32:07 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Oct 5, 2025):

Slug uniqueness is enforced when creating organizations, but not when updating them—so it's possible to update an organization's slug to one that's already in use, resulting in duplicates. This happens because the update logic doesn't check if the new slug is already taken by another organization before saving the change. The schema marks the slug as unique, but this isn't enforced at the application level during updates, and no recent changes address this gap (source).

As a workaround, you can manually check if a slug is already taken before calling the update API (for example, by querying for organizations with the desired slug and blocking the update if one exists). Alternatively, if you control the database schema, you can enforce a unique constraint on the slug column to prevent duplicates at the database level (source).

There isn't an official fix or patch for this yet, so keep an eye on future releases for an update.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3368803952 --> @dosubot[bot] commented on GitHub (Oct 5, 2025): <!-- Answer --> Slug uniqueness is enforced when creating organizations, but not when updating them—so it's possible to update an organization's slug to one that's already in use, resulting in duplicates. This happens because the update logic doesn't check if the new slug is already taken by another organization before saving the change. The schema marks the slug as unique, but this isn't enforced at the application level during updates, and no recent changes address this gap [(source)](https://github.com/better-auth/better-auth/issues/4965). As a workaround, you can manually check if a slug is already taken before calling the update API (for example, by querying for organizations with the desired slug and blocking the update if one exists). Alternatively, if you control the database schema, you can enforce a unique constraint on the slug column to prevent duplicates at the database level [(source)](https://github.com/better-auth/better-auth/issues/589). There isn't an official fix or patch for this yet, so keep an eye on future releases for an update. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/39f93787-a97d-4ee8-88d6-cad0f3f59b0c?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/39f93787-a97d-4ee8-88d6-cad0f3f59b0c?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/39f93787-a97d-4ee8-88d6-cad0f3f59b0c?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/39f93787-a97d-4ee8-88d6-cad0f3f59b0c?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/39f93787-a97d-4ee8-88d6-cad0f3f59b0c?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/39f93787-a97d-4ee8-88d6-cad0f3f59b0c?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/39f93787-a97d-4ee8-88d6-cad0f3f59b0c?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/5093)
GiteaMirror commented 2026-04-17 18:32:07 -05:00
Author
Owner
Copy Link
Copy Source

@kira-1011 commented on GitHub (Oct 5, 2025):

Hi! I'd like to work on this issue.

I've identified that the updateOrganization function in crud-org.ts is missing the slug uniqueness validation that exists in createOrganization.

My proposed fix:

  • Add slug uniqueness check in the update endpoint (similar to lines 150-157 in create)
  • Throw ORGANIZATION_ALREADY_EXISTS error if duplicate found
  • Add test case to prevent regression
<!-- gh-comment-id:3368857017 --> @kira-1011 commented on GitHub (Oct 5, 2025): Hi! I'd like to work on this issue. I've identified that the `updateOrganization` function in `crud-org.ts` is missing the slug uniqueness validation that exists in `createOrganization.` My proposed fix: - Add slug uniqueness check in the update endpoint (similar to lines 150-157 in create) - Throw `ORGANIZATION_ALREADY_EXISTS` error if duplicate found - Add test case to prevent regression
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#27484