github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #8385] Bug: organization invite role check does not handle multi-role users #28398

New Issue
Closed
opened 2026-04-17 19:51:27 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-17 19:51:27 -05:00
Owner
Copy Link

Originally created by @UdaraWanasinghe on GitHub (Mar 4, 2026).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/8385

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Go to packages/better-auth/src/plugins/organization/routes/crud-invites.ts, line 266.
Code currently checks:

if (
member.role !== creatorRole &&
roles.split(",").includes(creatorRole)
)

But member.role can contain multiple, comma-separated roles (e.g. "admin,member") so this check is incorrect.

Steps:

  1. Create a user who has multiple roles separated by commas
  2. Attempt an operation that triggers the invite logic for orgs
  3. Code incorrectly treats multi-roles as a single value

Current vs. Expected behavior

Current: The invite logic treats member.role as a single value and does not correctly detect if the creatorRole is present amongst multiple roles in member.role.

Expected: member.role should be split by "," and checked using !member.role.split(",").includes(creatorRole)

This will correctly detect if a user actually possesses the role for proper invite permissions.

What version of Better Auth are you using?

1.4.18

System info

{
  "system": {
    "platform": "linux",
    "arch": "x64",
    "version": "#1 ZEN SMP PREEMPT_DYNAMIC Fri, 14 Nov 2025 06:54:07 +0000",
    "release": "6.17.8-zen1-1-zen",
  },
  "node": {
    "version": "v25.2.0",
    "env": "production"
  },
  "packageManager": {
    "name": "bun",
    "version": "1.3.5"
  },
  "frameworks": null,
  "databases": null,
  "betterAuth": {
    "version": "Unknown",
    "config": null
  }
}

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

Additional context

No response

Originally created by @UdaraWanasinghe on GitHub (Mar 4, 2026). Original GitHub issue: https://github.com/better-auth/better-auth/issues/8385 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Go to packages/better-auth/src/plugins/organization/routes/crud-invites.ts, line 266. Code currently checks: if ( member.role !== creatorRole && roles.split(",").includes(creatorRole) ) But member.role can contain multiple, comma-separated roles (e.g. "admin,member") so this check is incorrect. Steps: 1. Create a user who has multiple roles separated by commas 2. Attempt an operation that triggers the invite logic for orgs 3. Code incorrectly treats multi-roles as a single value ### Current vs. Expected behavior Current: The invite logic treats member.role as a single value and does not correctly detect if the creatorRole is present amongst multiple roles in member.role. Expected: member.role should be split by "," and checked using !member.role.split(",").includes(creatorRole) This will correctly detect if a user actually possesses the role for proper invite permissions. ### What version of Better Auth are you using? 1.4.18 ### System info ```bash { "system": { "platform": "linux", "arch": "x64", "version": "#1 ZEN SMP PREEMPT_DYNAMIC Fri, 14 Nov 2025 06:54:07 +0000", "release": "6.17.8-zen1-1-zen", }, "node": { "version": "v25.2.0", "env": "production" }, "packageManager": { "name": "bun", "version": "1.3.5" }, "frameworks": null, "databases": null, "betterAuth": { "version": "Unknown", "config": null } } ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript ``` ### Additional context _No response_
GiteaMirror added the lockedbug labels 2026-04-17 19:51:27 -05:00
GiteaMirror commented 2026-04-17 19:51:29 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 4, 2026):

Good catch! I can confirm this bug exists at line 266 in crud-invites.ts. The strict equality check member.role !== creatorRole fails when member.role contains comma-separated roles like "admin,owner".

Interestingly, the very next line (roles.split(",").includes(creatorRole)) correctly handles comma-separated values, but member.role is not split similarly.

The fix you suggested is correct and matches the pattern used elsewhere in the codebase. For example, crud-members.ts handles this properly:

const roles = member.role.split(",");
const isOwner = roles.includes(creatorRole);

This bug hasn't been fixed yet - PR #6774 added role validation but didn't address this specific line.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

<!-- gh-comment-id:3999833067 --> @dosubot[bot] commented on GitHub (Mar 4, 2026): <!-- Answer --> Good catch! I can confirm this bug exists at [line 266 in crud-invites.ts](https://github.com/better-auth/better-auth/blob/8e1ddc3f81c11c2fff67e799edc2d742742f0603/packages/better-auth/src/plugins/organization/routes/crud-invites.ts#L265-L273). The strict equality check `member.role !== creatorRole` fails when `member.role` contains comma-separated roles like `"admin,owner"`. Interestingly, the very next line (`roles.split(",").includes(creatorRole)`) correctly handles comma-separated values, but `member.role` is not split similarly. The fix you suggested is correct and matches the pattern used elsewhere in the codebase. For example, [crud-members.ts](https://github.com/better-auth/better-auth/blob/8e1ddc3f81c11c2fff67e799edc2d742742f0603/packages/better-auth/src/plugins/organization/routes/crud-members.ts) handles this properly: ```typescript const roles = member.role.split(","); const isOwner = roles.includes(creatorRole); ``` This bug hasn't been fixed yet - [PR #6774](https://github.com/better-auth/better-auth/pull/6774) added role validation but didn't address this specific line. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/de421e0a-3fe8-4d9c-ab8a-48d7e5a29cb6?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/de421e0a-3fe8-4d9c-ab8a-48d7e5a29cb6?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/de421e0a-3fe8-4d9c-ab8a-48d7e5a29cb6?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/de421e0a-3fe8-4d9c-ab8a-48d7e5a29cb6?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/de421e0a-3fe8-4d9c-ab8a-48d7e5a29cb6?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/de421e0a-3fe8-4d9c-ab8a-48d7e5a29cb6?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/de421e0a-3fe8-4d9c-ab8a-48d7e5a29cb6?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=Good%20catch%21%20I%20can%20confirm%20this%20bug%20exists%20at%20%5Bline%20266%20in%20crud-invites.ts%5D%28https%3A//github.com/better-auth/better-auth/blob/8e1ddc3f81c11c2fff67e799edc2d742742f0603/packages/better-auth/src/plugins/organization/routes/crud-invites.ts%23L265-L273%29.%20The%20strict%20equality%20check%20%60member.role%20%21%3D%3D%20creatorRole%60%20fails%20when%20%60member.role%60%20contains%20comma-separated%20roles%20like%20%60%22admin%2Cowner%22%60.%0A%0AInterestingly%2C%20the%20very%20next%20line%20%28%60roles.split%28%22%2C%22%29.includes%28creatorRole%29%60%29%20correctly%20handles%20comma-separated%20values%2C%20but%20%60member.role%60%20is%20not%20split%20similarly.%0A%0AThe%20fix%20you%20suggested%20is%20correct%20and%20matches%20the%20pattern%20used%20elsewhere%20in%20the%20codebase.%20For%20example%2C%20%5Bcrud-members.ts%5D%28https%3A//github.com/better-auth/better-auth/blob/8e1ddc3f81c11c2fff67e799edc2d742742f0603/packages/better-auth/src/plugins/organization/routes/crud-members.ts%29%20handles%20this%20properly%3A%0A%0A%60%60%60typescript%0Aconst%20roles%20%3D%20member.role.split%28%22%2C%22%29%3B%0Aconst%20isOwner%20%3D%20roles.includes%28creatorRole%29%3B%0A%60%60%60%0A%0AThis%20bug%20hasn%27t%20been%20fixed%20yet%20-%20%5BPR%20%236774%5D%28https%3A//github.com/better-auth/better-auth/pull/6774%29%20added%20role%20validation%20but%20didn%27t%20address%20this%20specific%20line.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8385)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#28398
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?