github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #3023] [CLOSED] feat(rbac): Implement RBAC extends for organization plugin #4611

New Issue
Closed
opened 2026-03-13 11:52:40 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 11:52:40 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/3023
Author: @alialnaghmoush
Created: 6/14/2025
Status: ❌ Closed

Base: main ← Head: main

📝 Commits (5)

  • 156263a feat(rbac): Implement comprehensive RBAC extends organization plugin with customizable roles, permissions, and hooks
  • 55a8448 refactor(rbac): replace Rbac types with corresponding domain types for consistency
  • d3ed2e7 Refactor RBAC Organization Plugin: Clean up imports, improve logging, and enhance code readability
  • c5fa009 feat(rbac): Enhance RBAC functionality with improved permission checks, encryption methods, and comprehensive tests
  • f2ed4ec refactor(rbac): Rename userRole to memberRole for consistency across RBAC implementation

📊 Changes

17 files changed (+7514 additions, -1 deletions)

View changed files

📝 packages/better-auth/src/adapters/prisma-adapter/test/state.txt (+1 -1)
📝 packages/better-auth/src/client/plugins/index.ts (+2 -0)
📝 packages/better-auth/src/plugins/organization/index.ts (+5 -0)
➕ packages/better-auth/src/plugins/organization/rbac/README.md (+3003 -0)
➕ packages/better-auth/src/plugins/organization/rbac/index.ts (+7 -0)
➕ packages/better-auth/src/plugins/organization/rbac/rbac-adapter.ts (+690 -0)
➕ packages/better-auth/src/plugins/organization/rbac/rbac-client.ts (+400 -0)
➕ packages/better-auth/src/plugins/organization/rbac/rbac-hooks.ts (+401 -0)
➕ packages/better-auth/src/plugins/organization/rbac/rbac-organization.ts (+339 -0)
➕ packages/better-auth/src/plugins/organization/rbac/rbac-routes.ts (+926 -0)
➕ packages/better-auth/src/plugins/organization/rbac/rbac-schema.ts (+483 -0)
➕ packages/better-auth/src/plugins/organization/rbac/rbac-types.ts (+536 -0)
➕ packages/better-auth/src/plugins/organization/rbac/tests/example-usage.ts (+217 -0)
➕ packages/better-auth/src/plugins/organization/rbac/tests/rbac-comprehensive.test.ts (+309 -0)
➕ packages/better-auth/src/plugins/organization/rbac/tests/rbac-demo.ts (+72 -0)
➕ packages/better-auth/src/plugins/organization/rbac/tests/rbac-integration.test.ts (+56 -0)
➕ packages/better-auth/src/plugins/organization/rbac/tests/rbac-organization.test.ts (+67 -0)

📄 Description

✨ feat(rbac): Extend Organization Plugin with Full Database-Level RBAC

This PR introduces a comprehensive Role-Based Access Control (RBAC) system into the Better Auth Organization plugin with full database support, enabling enterprise-grade access management.

🧩 Highlights

  • Database-Level RBAC: Roles, permissions, assignments, policies, and audit logs are now persisted and manageable at the database level.
  • Role Hierarchy: Supports nested roles with permission inheritance.
  • Conditional Permissions: Grants based on time, IP, MFA, and resource attributes.
  • Resource-Based Access: Fine-grained controls for specific resources and actions.
  • Policy Engine: Custom JavaScript-based policies for dynamic permission checks.
  • Audit Trail: Logs every RBAC operation with IP/user-agent tracking.

⚙️ Core Features

  • RBAC config with customizable defaultRoles, customPermissions, and customResources
  • Hooks for lifecycle events (e.g., beforeRoleCreate, onUnauthorizedAccess)
  • Server-side & client-side RBAC APIs (CRUD roles/permissions, assign/revoke, check access)
  • Performance optimizations: caching, batching, Redis support
  • Migration tools from legacy org roles to full RBAC

🧪 Developer Experience

  • Full TypeScript support with typed APIs and IntelliSense
  • React client plugin with real-time updates and local caching
  • Database-agnostic (PostgreSQL, MySQL, SQLite)
  • Auto-migrations to set up required tables

📦 New Schema Tables

  • role, permission, rolePermission, memberRole, resource, policy, auditLog

🔗 More Information

See the full plugin documentation in the RBAC README

🚀 Why It Matters

This update transforms the organization plugin into a scalable and secure access control layer suitable for modern SaaS and enterprise apps, enabling robust authorization with compliance and performance in mind.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/3023 **Author:** [@alialnaghmoush](https://github.com/alialnaghmoush) **Created:** 6/14/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (5) - [`156263a`](https://github.com/better-auth/better-auth/commit/156263a959b9701d12bf2ebfdf5f61dd0edde55a) feat(rbac): Implement comprehensive RBAC extends organization plugin with customizable roles, permissions, and hooks - [`55a8448`](https://github.com/better-auth/better-auth/commit/55a84489bcffb05fc11b2b6894fb53927ae932e1) refactor(rbac): replace Rbac types with corresponding domain types for consistency - [`d3ed2e7`](https://github.com/better-auth/better-auth/commit/d3ed2e78301397d07d1244c21ec36339e6864ebc) Refactor RBAC Organization Plugin: Clean up imports, improve logging, and enhance code readability - [`c5fa009`](https://github.com/better-auth/better-auth/commit/c5fa0099fcab33bbd21b26bdae6403eab352dd87) feat(rbac): Enhance RBAC functionality with improved permission checks, encryption methods, and comprehensive tests - [`f2ed4ec`](https://github.com/better-auth/better-auth/commit/f2ed4ec0ea3019909fd4b80174c29649f3e94a5d) refactor(rbac): Rename userRole to memberRole for consistency across RBAC implementation ### 📊 Changes **17 files changed** (+7514 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/adapters/prisma-adapter/test/state.txt` (+1 -1) 📝 `packages/better-auth/src/client/plugins/index.ts` (+2 -0) 📝 `packages/better-auth/src/plugins/organization/index.ts` (+5 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/README.md` (+3003 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/index.ts` (+7 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/rbac-adapter.ts` (+690 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/rbac-client.ts` (+400 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/rbac-hooks.ts` (+401 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/rbac-organization.ts` (+339 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/rbac-routes.ts` (+926 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/rbac-schema.ts` (+483 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/rbac-types.ts` (+536 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/tests/example-usage.ts` (+217 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/tests/rbac-comprehensive.test.ts` (+309 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/tests/rbac-demo.ts` (+72 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/tests/rbac-integration.test.ts` (+56 -0) ➕ `packages/better-auth/src/plugins/organization/rbac/tests/rbac-organization.test.ts` (+67 -0) </details> ### 📄 Description ## ✨ feat(rbac): Extend Organization Plugin with Full Database-Level RBAC This PR introduces a comprehensive Role-Based Access Control (RBAC) system into the Better Auth Organization plugin with full database support, enabling enterprise-grade access management. ### 🧩 Highlights - **Database-Level RBAC**: Roles, permissions, assignments, policies, and audit logs are now persisted and manageable at the database level. - **Role Hierarchy**: Supports nested roles with permission inheritance. - **Conditional Permissions**: Grants based on time, IP, MFA, and resource attributes. - **Resource-Based Access**: Fine-grained controls for specific resources and actions. - **Policy Engine**: Custom JavaScript-based policies for dynamic permission checks. - **Audit Trail**: Logs every RBAC operation with IP/user-agent tracking. ### ⚙️ Core Features - RBAC config with customizable `defaultRoles`, `customPermissions`, and `customResources` - Hooks for lifecycle events (e.g., `beforeRoleCreate`, `onUnauthorizedAccess`) - Server-side & client-side RBAC APIs (CRUD roles/permissions, assign/revoke, check access) - Performance optimizations: caching, batching, Redis support - Migration tools from legacy org roles to full RBAC ### 🧪 Developer Experience - Full **TypeScript** support with typed APIs and IntelliSense - **React** client plugin with real-time updates and local caching - **Database-agnostic** (PostgreSQL, MySQL, SQLite) - Auto-migrations to set up required tables ### 📦 New Schema Tables - `role`, `permission`, `rolePermission`, `memberRole`, `resource`, `policy`, `auditLog` ### 🔗 More Information See the full plugin documentation in the [RBAC README](https://github.com/alialnaghmoush/better-auth/blob/main/packages/better-auth/src/plugins/organization/rbac/README.md) ### 🚀 Why It Matters This update transforms the organization plugin into a scalable and secure access control layer suitable for modern SaaS and enterprise apps, enabling robust authorization with compliance and performance in mind. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 11:52:40 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#4611
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?