github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #7837] Admin listUsers ignores valid falsy filter values #28245

New Issue
Closed
opened 2026-04-17 19:41:48 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-17 19:41:48 -05:00
Owner
Copy Link

Originally created by @coderrshyam on GitHub (Feb 7, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/7837

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Enable the admin plugin in Better Auth.
  2. Call the admin listUsers API with a filter that uses a falsy value.
    Example: filterField = "banned", filterValue = false.
  3. Check the response from the API.

Current vs. Expected behavior

Current behavior:
When filterValue is a falsy value (such as false, 0, or an empty string),
the filter is ignored. The API behaves as if no filter was provided and
returns unfiltered results.

Expected behavior:
Filters should be applied whenever filterValue is defined, even if the
value itself is falsy. For example, filtering users with banned = false
or emailVerified = false should work correctly.

What version of Better Auth are you using?

1.4.18

System info

{
  "node": "v24.x.x",
  "os": "windows",
  "better-auth": "1.4.18"
}

Which area(s) are affected? (Select all that apply)

Backend, Package

Auth config (if applicable)

import { betterAuth } from "better-auth"
import { admin } from "better-auth/plugins"

export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
  plugins: [
    admin() 
  ]
});

Additional context

The issue comes from a truthy check on ctx.query.filterValue in the admin
listUsers route, which skips valid falsy values such as false or 0.

Relevant code:
dd6dc4601f/packages/better-auth/src/plugins/admin/routes.ts (L658)

Changing the condition to explicitly check for undefined fixes the issue.
A fix and related test update are included in PR #7827.

It would be good to have this fix included in the upcoming minor release as well.

Originally created by @coderrshyam on GitHub (Feb 7, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/7837 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Enable the admin plugin in Better Auth. 2. Call the admin `listUsers` API with a filter that uses a falsy value. Example: `filterField = "banned", filterValue = false`. 3. Check the response from the API. ### Current vs. Expected behavior Current behavior: When `filterValue` is a falsy value (such as false, 0, or an empty string), the filter is ignored. The API behaves as if no filter was provided and returns unfiltered results. Expected behavior: Filters should be applied whenever `filterValue` is defined, even if the value itself is falsy. For example, filtering users with `banned = false` or `emailVerified = false` should work correctly. ### What version of Better Auth are you using? 1.4.18 ### System info ```bash { "node": "v24.x.x", "os": "windows", "better-auth": "1.4.18" } ``` ### Which area(s) are affected? (Select all that apply) Backend, Package ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" import { admin } from "better-auth/plugins" export const auth = betterAuth({ emailAndPassword: { enabled: true }, plugins: [ admin() ] }); ``` ### Additional context The issue comes from a truthy check on `ctx.query.filterValue` in the admin `listUsers` route, which skips valid falsy values such as `false` or `0`. Relevant code: https://github.com/better-auth/better-auth/blob/dd6dc4601ff1c5a68f869fb285d3a9bd48074b66/packages/better-auth/src/plugins/admin/routes.ts#L658 Changing the condition to explicitly check for `undefined` fixes the issue. A fix and related test update are included in PR #7827. It would be good to have this fix included in the upcoming minor release as well.
GiteaMirror added the lockedbug labels 2026-04-17 19:41:49 -05:00
GiteaMirror commented 2026-04-17 19:41:50 -05:00
Author
Owner
Copy Link

@better-auth-agent[bot] commented on GitHub (Feb 7, 2026):

It seems you've opened an issue regarding the admin listUsers function where it ignores valid falsy filter values like false and returns unfiltered results. This is a known behavior caused by a truthy check on ctx.query.filterValue, which unintentionally skips valid falsy values.

The expected behavior would be for filters to apply even when filterValue is falsy. A potential fix involves changing the condition to explicitly check for undefined. There is already a related PR (#7827) that addresses this issue and proposes fixes and tests.

To proceed, you might want to implement the suggested changes or reference the ongoing PR for updates. If you have more questions or need further assistance, feel free to tag @better-auth-agent! Would you like to know more about how to implement the proposed fix?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

<!-- gh-comment-id:3863735739 --> @better-auth-agent[bot] commented on GitHub (Feb 7, 2026): It seems you've opened an issue regarding the `admin listUsers` function where it ignores valid falsy filter values like `false` and returns unfiltered results. This is a known behavior caused by a truthy check on `ctx.query.filterValue`, which unintentionally skips valid falsy values. The expected behavior would be for filters to apply even when `filterValue` is falsy. A potential fix involves changing the condition to explicitly check for `undefined`. There is already a related PR (#7827) that addresses this issue and proposes fixes and tests. To proceed, you might want to implement the suggested changes or reference the ongoing PR for updates. If you have more questions or need further assistance, feel free to tag @better-auth-agent! Would you like to know more about how to implement the proposed fix? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28245
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?