github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-16 23:20:14 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #7356] Dynamic Access Control endpoints missing with teams enabled #28115

New Issue
Closed
opened 2026-04-17 19:31:06 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-04-17 19:31:06 -05:00
Owner
Copy Link

Originally created by @UdaraWanasinghe on GitHub (Jan 14, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/7356

Bug: Dynamic Access Control endpoints not available when teams are enabled

Describe the problem

When configuring the organization plugin in Better Auth as follows:

organization({
  ac,
  dynamicAccessControl:  {
    enabled: true,
  },
  teams: {
    enabled: true,
  },
})

The createOrgRole endpoint (for dynamic access control) is not available in the API. However, if teams: { enabled: false } is set, the createOrgRole endpoint is available.

Expected behavior

  • The endpoints from DynamicAccessControlEndpoints (like createOrgRole) should be present regardless of whether teams are enabled, as long as dynamic access control is enabled.
  • Both teams and dynamic access control should work together as per runtime logic.

Actual behavior

  • When both teams.enabled and dynamicAccessControl.enabled are true, dynamic access control endpoints are missing from the API.

Possible cause

  • TypeScript function overload or type inference in the plugin codebase may be shadowing endpoints or narrowing typings, leading to only team endpoints or incorrect endpoint composition.
  • Runtime logic suggests both endpoints should be combined unless overwritten by type definitions.

Steps to reproduce

  1. Configure Better Auth with both features enabled as shown above.
  2. Attempt to use API endpoint createOrgRole.
  3. Endpoint is undefined/missing in the exported API.
  4. Switch teams to enabled: false, and observe the endpoint appears.

Environment

  • better-auth version: 1.4.12
  • TypeScript version: 5.9.3

Additional context

Labels: bug, config, organization, role

Originally created by @UdaraWanasinghe on GitHub (Jan 14, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/7356 ## Bug: Dynamic Access Control endpoints not available when teams are enabled **Describe the problem** When configuring the organization plugin in Better Auth as follows: ```ts organization({ ac, dynamicAccessControl: { enabled: true, }, teams: { enabled: true, }, }) ``` The `createOrgRole` endpoint (for dynamic access control) is not available in the API. However, if `teams: { enabled: false }` is set, the `createOrgRole` endpoint is available. **Expected behavior** - The endpoints from `DynamicAccessControlEndpoints` (like `createOrgRole`) should be present regardless of whether teams are enabled, as long as dynamic access control is enabled. - Both teams and dynamic access control should work together as per [runtime logic](https://github.com/better-auth/better-auth/blob/34c8a4bd2a7a60cbf1232141ca270c08045e1af6/packages/better-auth/src/plugins/organization/organization.ts#L908-L927). **Actual behavior** - When both `teams.enabled` and `dynamicAccessControl.enabled` are `true`, dynamic access control endpoints are missing from the API. **Possible cause** - TypeScript function overload or type inference in the plugin codebase may be shadowing endpoints or narrowing typings, leading to only team endpoints or incorrect endpoint composition. - Runtime logic suggests both endpoints should be combined unless overwritten by type definitions. **Steps to reproduce** 1. Configure Better Auth with both features enabled as shown above. 2. Attempt to use API endpoint `createOrgRole`. 3. Endpoint is undefined/missing in the exported API. 4. Switch teams to `enabled: false`, and observe the endpoint appears. **Environment** - better-auth version: 1.4.12 - TypeScript version: 5.9.3 **Additional context** - See overloaded function definitions and endpoint composition [here](https://github.com/better-auth/better-auth/blob/34c8a4bd2a7a60cbf1232141ca270c08045e1af6/packages/better-auth/src/plugins/organization/organization.ts#L344-L436) and [endpoint aggregation logic](https://github.com/better-auth/better-auth/blob/34c8a4bd2a7a60cbf1232141ca270c08045e1af6/packages/better-auth/src/plugins/organization/organization.ts#L908-L927). **Labels:** bug, config, organization, role
GiteaMirror added the lockedbug labels 2026-04-17 19:31:06 -05:00
GiteaMirror commented 2026-04-17 19:31:07 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Jan 14, 2026):

It looks like you've encountered an issue where the createOrgRole endpoint from dynamic access control is missing when both teams and dynamic access control are enabled in Better Auth. This is likely due to a conflict or limitations in the type definitions or endpoint composition logic when both features are active.

Here are the next steps you can take:

  1. Check the Plugin Configuration: Ensure that the plugin configuration is correct and matches the expected setup as per the documentation.

  2. Review the API Response: Double-check the API documentation or logs to confirm if the endpoint is indeed missing when both configurations are enabled.

  3. Look for Related Issues: There are known issues concerning conflicts when enabling both features [1]. You may want to review those or even add to them if your case hasn't been documented.

  4. Reach Out to the Team: If the problem persists, it might be best to tag members of the Better Auth team—Beka (@bekacru) or Max (@ping__)—who can provide further assistance.

Do you need help with anything else regarding Better Auth, or is there something specific you'd like to dive deeper into?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3749605335 --> @better-auth-agent[bot] commented on GitHub (Jan 14, 2026): It looks like you've encountered an issue where the `createOrgRole` endpoint from dynamic access control is missing when both teams and dynamic access control are enabled in Better Auth. This is likely due to a conflict or limitations in the type definitions or endpoint composition logic when both features are active. Here are the next steps you can take: 1. **Check the Plugin Configuration**: Ensure that the plugin configuration is correct and matches the expected setup as per the documentation. 2. **Review the API Response**: Double-check the API documentation or logs to confirm if the endpoint is indeed missing when both configurations are enabled. 3. **Look for Related Issues**: There are known issues concerning conflicts when enabling both features [[1]](https://github.com/better-auth/better-auth/issues/6270). You may want to review those or even add to them if your case hasn't been documented. 4. **Reach Out to the Team**: If the problem persists, it might be best to tag members of the Better Auth team—Beka (@bekacru) or Max (@ping__)—who can provide further assistance. Do you need help with anything else regarding Better Auth, or is there something specific you'd like to dive deeper into? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-04-17 19:31:08 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Jan 14, 2026):

Hi @UdaraWanasinghe! I'm Dosu and I’m helping the better-auth team.

This is a known issue in Better Auth 1.4.12: when both teams and dynamicAccessControl are enabled in the organization plugin, endpoints like createOrgRole are missing due to TypeScript type inference and endpoint composition conflicts. The runtime logic does merge all endpoints, but the final exposed type narrows the API, causing TypeScript to drop dynamic access control routes when teams are enabled—even though the runtime object actually includes them. This mismatch is caused by how overloads and endpoint aggregation are implemented in the plugin code (see code).

Workarounds for 1.4.12 include relaxing strict TypeScript options (especially setting "exactOptionalPropertyTypes": false in your tsconfig.json) or using type assertions (e.g., as any) for affected API calls. These unblock development but reduce type safety and are not ideal for production (see related issue).

A robust fix was merged after 1.4.12 in PR #5334 (2025-10-15), which refactored endpoint type composition to safely combine dynamic access control and teams endpoints. Upgrading to a version that includes this PR will resolve the bug and restore all expected endpoints when both features are enabled.

If you need to keep using 1.4.12, use the workarounds above. For a long-term solution, upgrade to the latest version after PR #5334.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3749615093 --> @dosubot[bot] commented on GitHub (Jan 14, 2026): <!-- Greeting --> Hi @UdaraWanasinghe! I'm [Dosu](https://go.dosu.dev/dosubot) and I’m helping the better-auth team. <!-- Answer --> This is a known issue in Better Auth 1.4.12: when both `teams` and `dynamicAccessControl` are enabled in the organization plugin, endpoints like `createOrgRole` are missing due to TypeScript type inference and endpoint composition conflicts. The runtime logic does merge all endpoints, but the final exposed type narrows the API, causing TypeScript to drop dynamic access control routes when teams are enabled—even though the runtime object actually includes them. This mismatch is caused by how overloads and endpoint aggregation are implemented in the plugin code [(see code)](https://github.com/better-auth/better-auth/blob/c321986fc60a8a2494e63c4d3c95e40cd65a4cf5/packages/better-auth/src/plugins/organization/organization.ts#L333-L1194). Workarounds for 1.4.12 include relaxing strict TypeScript options (especially setting `"exactOptionalPropertyTypes": false` in your `tsconfig.json`) or using type assertions (e.g., `as any`) for affected API calls. These unblock development but reduce type safety and are not ideal for production [(see related issue)](https://github.com/better-auth/better-auth/issues/5119). A robust fix was merged after 1.4.12 in [PR #5334](https://github.com/better-auth/better-auth/pull/5334) (2025-10-15), which refactored endpoint type composition to safely combine dynamic access control and teams endpoints. Upgrading to a version that includes this PR will resolve the bug and restore all expected endpoints when both features are enabled. If you need to keep using 1.4.12, use the workarounds above. For a long-term solution, upgrade to the latest version after PR #5334. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/0965d3fe-ada2-490c-bcfa-426a8afb8635?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/0965d3fe-ada2-490c-bcfa-426a8afb8635?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/0965d3fe-ada2-490c-bcfa-426a8afb8635?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/0965d3fe-ada2-490c-bcfa-426a8afb8635?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/0965d3fe-ada2-490c-bcfa-426a8afb8635?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/0965d3fe-ada2-490c-bcfa-426a8afb8635?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/0965d3fe-ada2-490c-bcfa-426a8afb8635?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20is%20a%20known%20issue%20in%20Better%20Auth%201.4.12%3A%20when%20both%20%60teams%60%20and%20%60dynamicAccessControl%60%20are%20enabled%20in%20the%20organization%20plugin%2C%20endpoints%20like%20%60createOrgRole%60%20are%20missing%20due%20to%20TypeScript%20type%20inference%20and%20endpoint%20composition%20conflicts.%20The%20runtime%20logic%20does%20merge%20all%20endpoints%2C%20but%20the%20final%20exposed%20type%20narrows%20the%20API%2C%20causing%20TypeScript%20to%20drop%20dynamic%20access%20control%20routes%20when%20teams%20are%20enabled%E2%80%94even%20though%20the%20runtime%20object%20actually%20includes%20them.%20This%20mismatch%20is%20caused%20by%20how%20overloads%20and%20endpoint%20aggregation%20are%20implemented%20in%20the%20plugin%20code%20%5B%28see%20code%29%5D%28https%3A//github.com/better-auth/better-auth/blob/c321986fc60a8a2494e63c4d3c95e40cd65a4cf5/packages/better-auth/src/plugins/organization/organization.ts%23L333-L1194%29.%0A%0AWorkarounds%20for%201.4.12%20include%20relaxing%20strict%20TypeScript%20options%20%28especially%20setting%20%60%22exactOptionalPropertyTypes%22%3A%20false%60%20in%20your%20%60tsconfig.json%60%29%20or%20using%20type%20assertions%20%28e.g.%2C%20%60as%20any%60%29%20for%20affected%20API%20calls.%20These%20unblock%20development%20but%20reduce%20type%20safety%20and%20are%20not%20ideal%20for%20production%20%5B%28see%20related%20issue%29%5D%28https%3A//github.com/better-auth/better-auth/issues/5119%29.%0A%0AA%20robust%20fix%20was%20merged%20after%201.4.12%20in%20%5BPR%20%235334%5D%28https%3A//github.com/better-auth/better-auth/pull/5334%29%20%282025-10-15%29%2C%20which%20refactored%20endpoint%20type%20composition%20to%20safely%20combine%20dynamic%20access%20control%20and%20teams%20endpoints.%20Upgrading%20to%20a%20version%20that%20includes%20this%20PR%20will%20resolve%20the%20bug%20and%20restore%20all%20expected%20endpoints%20when%20both%20features%20are%20enabled.%0A%0AIf%20you%20need%20to%20keep%20using%201.4.12%2C%20use%20the%20workarounds%20above.%20For%20a%20long-term%20solution%2C%20upgrade%20to%20the%20latest%20version%20after%20PR%20%235334.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/7356)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28115
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?