github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7414] [MERGED] fix: centralize schema parsing for API responses #32896

New Issue
Closed
opened 2026-04-17 23:36:17 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-17 23:36:17 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7414
Author: @bytaesu
Created: 1/16/2026
Status: ✅ Merged
Merged: 1/16/2026
Merged by: @himself65

Base: canary ← Head: 2026-01-16/fix/response-fields

📝 Commits (10+)

  • 45fc543 fix: add returned options to core schema
  • 5223a16 fix: add generic to helpers and includeCoreSchema to distinguish returned option
  • 4969d87 refactor: clearer helper function param
  • 3eb0aed fix: make scope returned
  • 0331000 refactor: improve type inference
  • 8a6bfd6 fix: remove duplicate id field and refactor helpers order
  • a69fcd7 fix: use schema parsers for centralized type inference
  • efee920 fix: rehydrate date fields from cookie cache
  • aba433d fix: make id always returned
  • a29fe8c test: add regression test cases for additionalFields

📊 Changes

20 files changed (+272 additions, -241 deletions)

View changed files

📝 packages/better-auth/src/api/routes/account.ts (+8 -9)
📝 packages/better-auth/src/api/routes/email-verification.ts (+6 -10)
📝 packages/better-auth/src/api/routes/session-api.test.ts (+46 -0)
📝 packages/better-auth/src/api/routes/session.ts (+30 -8)
📝 packages/better-auth/src/api/routes/sign-in.test.ts (+46 -0)
📝 packages/better-auth/src/api/routes/sign-up.test.ts (+17 -0)
📝 packages/better-auth/src/api/routes/update-user.ts (+2 -10)
📝 packages/better-auth/src/db/schema.ts (+52 -25)
📝 packages/better-auth/src/plugins/admin/routes.ts (+22 -13)
📝 packages/better-auth/src/plugins/anonymous/index.ts (+2 -9)
📝 packages/better-auth/src/plugins/email-otp/routes.ts (+5 -36)
📝 packages/better-auth/src/plugins/magic-link/index.ts (+2 -9)
📝 packages/better-auth/src/plugins/multi-session/index.ts (+11 -2)
📝 packages/better-auth/src/plugins/one-tap/index.ts (+3 -18)
📝 packages/better-auth/src/plugins/phone-number/routes.ts (+5 -44)
📝 packages/better-auth/src/plugins/two-factor/backup-codes/index.ts (+2 -9)
📝 packages/better-auth/src/plugins/two-factor/otp/index.ts (+2 -9)
📝 packages/better-auth/src/plugins/two-factor/verify-two-factor.ts (+3 -18)
📝 packages/better-auth/src/plugins/username/index.ts (+2 -12)
📝 packages/core/src/db/get-tables.ts (+6 -0)

📄 Description

  • Centralize "user", "session" and "account" output parsing in db/schema.ts.
  • Apply parsers across 17 routes/plugins.
  • To ensure account sensitive fields are not returned even if route-level filtering is missed, returned: false was added to the core schema to improve runtime safety.
  • Ensure returned: false fields are consistently filtered.

Note

In places like the Organization and SIWE plugins, the returned user objects differ slightly, and since it’s unclear whether this is intentional or due to missing fields, the change was not applied there.

Summary by cubic

Centralized response parsing for user, session, and account objects to ensure consistent shapes and automatically filter sensitive fields across the API. This improves runtime safety and reduces duplicate mapping across 17 routes/plugins.

  • Bug Fixes

    • Sensitive account fields (accessToken, refreshToken, idToken, token expirations, password) are now marked returned:false in the core schema and filtered from all responses.
    • Rehydrated date fields in cookie-cache paths to keep session date types consistent across refresh; added tests to validate consistency.
    • Account scope is now included in outputs; account listing still returns scopes[].

  • Refactors

    • Added parseUserOutput, parseSessionOutput, parseAccountOutput and applied them across routes/plugins.
    • Consolidated schema resolution with getFields(options, table, mode) and caching; core schema is included for output parsing, and id is always returned.
    • Removed ad-hoc response shaping; outputs include additionalFields automatically.
    • Left Organization and SIWE plugin user responses unchanged due to differing shapes.

Written for commit a29fe8cb74. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7414 **Author:** [@bytaesu](https://github.com/bytaesu) **Created:** 1/16/2026 **Status:** ✅ Merged **Merged:** 1/16/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `2026-01-16/fix/response-fields` --- ### 📝 Commits (10+) - [`45fc543`](https://github.com/better-auth/better-auth/commit/45fc5432eba6d2cfbb7f7f852850bb940dea932a) fix: add returned options to core schema - [`5223a16`](https://github.com/better-auth/better-auth/commit/5223a169cbb394adf2cc7b52a01d592a1d4ee293) fix: add generic to helpers and includeCoreSchema to distinguish returned option - [`4969d87`](https://github.com/better-auth/better-auth/commit/4969d8727a35a674e67c940b1de8456bb7abd52c) refactor: clearer helper function param - [`3eb0aed`](https://github.com/better-auth/better-auth/commit/3eb0aed65034eb73275c443fe99e3b912ab6e70f) fix: make scope returned - [`0331000`](https://github.com/better-auth/better-auth/commit/03310000e37d7f22d54969db0e57603f0056e488) refactor: improve type inference - [`8a6bfd6`](https://github.com/better-auth/better-auth/commit/8a6bfd663355bbb54c1c549b7bf6be936af00cb9) fix: remove duplicate id field and refactor helpers order - [`a69fcd7`](https://github.com/better-auth/better-auth/commit/a69fcd767e522154173793b83c48684b7c922aa7) fix: use schema parsers for centralized type inference - [`efee920`](https://github.com/better-auth/better-auth/commit/efee920a0138b36fb287b9b4cd0039f4c588e735) fix: rehydrate date fields from cookie cache - [`aba433d`](https://github.com/better-auth/better-auth/commit/aba433d3c9895a867ca1f386f3f8e60546cf455b) fix: make id always returned - [`a29fe8c`](https://github.com/better-auth/better-auth/commit/a29fe8cb74687fd18dd401b5f8145c3e1e899b45) test: add regression test cases for additionalFields ### 📊 Changes **20 files changed** (+272 additions, -241 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/api/routes/account.ts` (+8 -9) 📝 `packages/better-auth/src/api/routes/email-verification.ts` (+6 -10) 📝 `packages/better-auth/src/api/routes/session-api.test.ts` (+46 -0) 📝 `packages/better-auth/src/api/routes/session.ts` (+30 -8) 📝 `packages/better-auth/src/api/routes/sign-in.test.ts` (+46 -0) 📝 `packages/better-auth/src/api/routes/sign-up.test.ts` (+17 -0) 📝 `packages/better-auth/src/api/routes/update-user.ts` (+2 -10) 📝 `packages/better-auth/src/db/schema.ts` (+52 -25) 📝 `packages/better-auth/src/plugins/admin/routes.ts` (+22 -13) 📝 `packages/better-auth/src/plugins/anonymous/index.ts` (+2 -9) 📝 `packages/better-auth/src/plugins/email-otp/routes.ts` (+5 -36) 📝 `packages/better-auth/src/plugins/magic-link/index.ts` (+2 -9) 📝 `packages/better-auth/src/plugins/multi-session/index.ts` (+11 -2) 📝 `packages/better-auth/src/plugins/one-tap/index.ts` (+3 -18) 📝 `packages/better-auth/src/plugins/phone-number/routes.ts` (+5 -44) 📝 `packages/better-auth/src/plugins/two-factor/backup-codes/index.ts` (+2 -9) 📝 `packages/better-auth/src/plugins/two-factor/otp/index.ts` (+2 -9) 📝 `packages/better-auth/src/plugins/two-factor/verify-two-factor.ts` (+3 -18) 📝 `packages/better-auth/src/plugins/username/index.ts` (+2 -12) 📝 `packages/core/src/db/get-tables.ts` (+6 -0) </details> ### 📄 Description - Centralize "user", "session" and "account" output parsing in `db/schema.ts`. - Apply parsers across 17 routes/plugins. - To ensure account sensitive fields are not returned even if route-level filtering is missed, `returned: false` was added to the core schema to improve runtime safety. - Ensure `returned: false` fields are consistently filtered. > [!NOTE] > In places like the Organization and SIWE plugins, the returned user objects differ slightly, and since it’s unclear whether this is intentional or due to missing fields, the change was not applied there. - Closes #1459 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Centralized response parsing for user, session, and account objects to ensure consistent shapes and automatically filter sensitive fields across the API. This improves runtime safety and reduces duplicate mapping across 17 routes/plugins. - **Bug Fixes** - Sensitive account fields (accessToken, refreshToken, idToken, token expirations, password) are now marked returned:false in the core schema and filtered from all responses. - Rehydrated date fields in cookie-cache paths to keep session date types consistent across refresh; added tests to validate consistency. - Account scope is now included in outputs; account listing still returns scopes[]. - **Refactors** - Added parseUserOutput, parseSessionOutput, parseAccountOutput and applied them across routes/plugins. - Consolidated schema resolution with getFields(options, table, mode) and caching; core schema is included for output parsing, and id is always returned. - Removed ad-hoc response shaping; outputs include additionalFields automatically. - Left Organization and SIWE plugin user responses unchanged due to differing shapes. <sup>Written for commit a29fe8cb74687fd18dd401b5f8145c3e1e899b45. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-17 23:36:17 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#32896
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?