github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Incorrect OAS definition after updating to OAS 3.1 in Better Auth 1.5.2 #2984

New Issue
Open
opened 2026-03-13 10:32:28 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-13 10:32:28 -05:00
Owner
Copy Link

Originally created by @nachomglz on GitHub (Mar 4, 2026).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

I discovered this issue by trying to generate an API client using Orval.

  1. Try to create an api client using orval or any other OAS -> TS api generators
  2. Error is thrown
  3. After reviewing the definition, the response schema of the get-session endpoint has nullable:true when that's no longer available in OAS 3.1

Current vs. Expected behavior

I expected the definition to be generated, but I got this error instead:

> npx orval

🍻 orval v8.5.1 - A swagger client generator for typescript
Running afterAllFilesWrite hook...
🎉 identity - Your OpenAPI spec has been converted into ready to use orval!
🛑 auth - Validation failed
  Cause: [
  {
    "message": "if must match \"else\" schema",
    "path": "/paths/~1get-session"
  },
  {
    "message": "type must be object",
    "path": "/paths/~1get-session/post/responses/200"
  },
  {
    "message": "if must match \"else\" schema",
    "path": "/paths/~1get-session/post/responses/200"
  }
]
🛑 authZod - Validation failed
  Cause: [
  {
    "message": "if must match \"else\" schema",
    "path": "/paths/~1get-session"
  },
  {
    "message": "type must be object",
    "path": "/paths/~1get-session/post/responses/200"
  },
  {
    "message": "if must match \"else\" schema",
    "path": "/paths/~1get-session/post/responses/200"
  }
]
Running afterAllFilesWrite hook...

What version of Better Auth are you using?

1.5.3

System info

{
  "system": {
    "platform": "darwin",
    "arch": "arm64",
    "version": "Darwin Kernel Version 25.1.0: Mon Oct 20 19:34:03 PDT 2025; root:xnu-12377.41.6~2/RELEASE_ARM64_T8142",
    "release": "25.1.0",
    "cpuCount": 10,
    "cpuModel": "Apple M5",
    "totalMemory": "24.00 GB",
    "freeMemory": "0.18 GB"
  },
  "node": {
    "version": "v22.22.0",
    "env": "development"
  },
  "packageManager": {
    "name": "npm",
    "version": "10.9.4"
  },
  "frameworks": [
    {
      "name": "fastify",
      "version": "^5.7.4"
    },
    {
      "name": "hono",
      "version": "^4.11.9"
    }
  ],
  "databases": [
    {
      "name": "pg",
      "version": "^8.13.1"
    },
    {
      "name": "@prisma/client",
      "version": "^7.3.0"
    }
  ],
  "betterAuth": {
    "version": "Unknown",
    "config": null,
    "error": "Invalid environment variables"
  }
}

Which area(s) are affected? (Select all that apply)

Client

Auth config (if applicable)

export const auth = betterAuth({
  baseURL: env.BASE_URL,
  basePath: '/api/v1/auth',
  trustedOrigins: [...],
  database: prismaAdapter(prisma, {
    provider: '...',
  }),
  plugins: [
    openAPI({ disableDefaultReference: true }),
    organization(...),
    apiKey(),
    anonymous(),
    jwt(...),
  ],
  user: {...},
  emailAndPassword: {
    enabled: true,
  },
  session: {
    expiresIn: ...,
    updateAge: ...,
    cookieCache: {
      enabled: false,
    },
  },
  socialProviders: {
    google: {...},
  },
})

Additional context

I tested agains v1.5.2 and v1.5.3

Originally created by @nachomglz on GitHub (Mar 4, 2026). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce I discovered this issue by trying to generate an API client using [Orval](https://orval.dev/). 1. Try to create an api client using orval or any other OAS -> TS api generators 2. Error is thrown 3. After reviewing the definition, the response schema of the `get-session` endpoint has `nullable:true` when that's no longer available in OAS 3.1 ### Current vs. Expected behavior I expected the definition to be generated, but I got this error instead: ``` > npx orval 🍻 orval v8.5.1 - A swagger client generator for typescript Running afterAllFilesWrite hook... 🎉 identity - Your OpenAPI spec has been converted into ready to use orval! 🛑 auth - Validation failed Cause: [ { "message": "if must match \"else\" schema", "path": "/paths/~1get-session" }, { "message": "type must be object", "path": "/paths/~1get-session/post/responses/200" }, { "message": "if must match \"else\" schema", "path": "/paths/~1get-session/post/responses/200" } ] 🛑 authZod - Validation failed Cause: [ { "message": "if must match \"else\" schema", "path": "/paths/~1get-session" }, { "message": "type must be object", "path": "/paths/~1get-session/post/responses/200" }, { "message": "if must match \"else\" schema", "path": "/paths/~1get-session/post/responses/200" } ] Running afterAllFilesWrite hook... ``` ### What version of Better Auth are you using? 1.5.3 ### System info ```bash { "system": { "platform": "darwin", "arch": "arm64", "version": "Darwin Kernel Version 25.1.0: Mon Oct 20 19:34:03 PDT 2025; root:xnu-12377.41.6~2/RELEASE_ARM64_T8142", "release": "25.1.0", "cpuCount": 10, "cpuModel": "Apple M5", "totalMemory": "24.00 GB", "freeMemory": "0.18 GB" }, "node": { "version": "v22.22.0", "env": "development" }, "packageManager": { "name": "npm", "version": "10.9.4" }, "frameworks": [ { "name": "fastify", "version": "^5.7.4" }, { "name": "hono", "version": "^4.11.9" } ], "databases": [ { "name": "pg", "version": "^8.13.1" }, { "name": "@prisma/client", "version": "^7.3.0" } ], "betterAuth": { "version": "Unknown", "config": null, "error": "Invalid environment variables" } } ``` ### Which area(s) are affected? (Select all that apply) Client ### Auth config (if applicable) ```typescript export const auth = betterAuth({ baseURL: env.BASE_URL, basePath: '/api/v1/auth', trustedOrigins: [...], database: prismaAdapter(prisma, { provider: '...', }), plugins: [ openAPI({ disableDefaultReference: true }), organization(...), apiKey(), anonymous(), jwt(...), ], user: {...}, emailAndPassword: { enabled: true, }, session: { expiresIn: ..., updateAge: ..., cookieCache: { enabled: false, }, }, socialProviders: { google: {...}, }, }) ``` ### Additional context I tested agains v1.5.2 and v1.5.3
GiteaMirror added the bug label 2026-03-13 10:32:28 -05:00
GiteaMirror commented 2026-03-13 10:32:30 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Mar 4, 2026):

This is a known issue tracked in #6691. The problem is that the OpenAPI schema version is set to 3.1.1, but the /get-session endpoint still uses nullable: true which is only valid in OpenAPI 3.0.

PR #6705 fixed nullable type handling for Zod-generated schemas by converting them to OpenAPI 3.1 format (anyOf: [schema, { type: "null" }] for objects). However, the get-session endpoint has hardcoded OpenAPI metadata that bypasses this conversion logic, which is why the fix didn't resolve this specific endpoint.

Workaround: Post-process the generated OpenAPI spec to replace nullable: true with OpenAPI 3.1 compliant syntax before running Orval.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Mar 4, 2026): <!-- Answer --> This is a known issue tracked in [#6691](https://github.com/better-auth/better-auth/issues/6691). The problem is that the OpenAPI schema version is set to 3.1.1, but the `/get-session` endpoint [still uses `nullable: true`](https://github.com/better-auth/better-auth/blob/8e1ddc3f81c11c2fff67e799edc2d742742f0603/packages/better-auth/src/api/routes/session.ts#L31-L67) which is only valid in OpenAPI 3.0. [PR #6705](https://github.com/better-auth/better-auth/pull/6705) fixed nullable type handling for Zod-generated schemas by converting them to OpenAPI 3.1 format (`anyOf: [schema, { type: "null" }]` for objects). However, the `get-session` endpoint has **hardcoded OpenAPI metadata** that bypasses this conversion logic, which is why the fix didn't resolve this specific endpoint. **Workaround**: Post-process the generated OpenAPI spec to replace `nullable: true` with OpenAPI 3.1 compliant syntax before running Orval. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/42afcf37-a3f1-4fef-8fd1-ef05974c92df?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/42afcf37-a3f1-4fef-8fd1-ef05974c92df?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/42afcf37-a3f1-4fef-8fd1-ef05974c92df?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/42afcf37-a3f1-4fef-8fd1-ef05974c92df?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/42afcf37-a3f1-4fef-8fd1-ef05974c92df?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/42afcf37-a3f1-4fef-8fd1-ef05974c92df?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/42afcf37-a3f1-4fef-8fd1-ef05974c92df?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=This%20is%20a%20known%20issue%20tracked%20in%20%5B%236691%5D%28https%3A//github.com/better-auth/better-auth/issues/6691%29.%20The%20problem%20is%20that%20the%20OpenAPI%20schema%20version%20is%20set%20to%203.1.1%2C%20but%20the%20%60/get-session%60%20endpoint%20%5Bstill%20uses%20%60nullable%3A%20true%60%5D%28https%3A//github.com/better-auth/better-auth/blob/8e1ddc3f81c11c2fff67e799edc2d742742f0603/packages/better-auth/src/api/routes/session.ts%23L31-L67%29%20which%20is%20only%20valid%20in%20OpenAPI%203.0.%0A%0A%5BPR%20%236705%5D%28https%3A//github.com/better-auth/better-auth/pull/6705%29%20fixed%20nullable%20type%20handling%20for%20Zod-generated%20schemas%20by%20converting%20them%20to%20OpenAPI%203.1%20format%20%28%60anyOf%3A%20%5Bschema%2C%20%7B%20type%3A%20%22null%22%20%7D%5D%60%20for%20objects%29.%20However%2C%20the%20%60get-session%60%20endpoint%20has%20%2A%2Ahardcoded%20OpenAPI%20metadata%2A%2A%20that%20bypasses%20this%20conversion%20logic%2C%20which%20is%20why%20the%20fix%20didn%27t%20resolve%20this%20specific%20endpoint.%0A%0A%2A%2AWorkaround%2A%2A%3A%20Post-process%20the%20generated%20OpenAPI%20spec%20to%20replace%20%60nullable%3A%20true%60%20with%20OpenAPI%203.1%20compliant%20syntax%20before%20running%20Orval.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/8367)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2984
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?