github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-24 16:11:53 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #4087] [MERGED] feat(org): Dynamic Access Control #5179

New Issue
Closed
opened 2026-03-13 12:13:07 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:13:07 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/4087
Author: @ping-maxwell
Created: 8/19/2025
Status: ✅ Merged
Merged: 8/31/2025
Merged by: @himself65

Base: canary ← Head: feat/org/dynamic-access-control

📝 Commits (10+)

  • 3aab358 feat(org): Dynamic Access Control
  • 3220968 chore: lint
  • 13e2544 fix: cubic suggestions
  • 7a9ad2a update: code cleanup
  • be9d9b6 Merge branch 'canary' into feat/org/dynamic-access-control
  • 221c276 Merge branch 'canary' into feat/org/dynamic-access-control
  • 25c46d2 Merge branch 'canary' into feat/org/dynamic-access-control
  • 67dc465 Merge branch 'canary' into feat/org/dynamic-access-control
  • 78508ab Update packages/better-auth/src/plugins/organization/routes/crud-access-control.ts
  • 0ce66a1 update: added onUpdate

📊 Changes

15 files changed (+3042 additions, -100 deletions)

View changed files

📝 docs/content/docs/plugins/organization.mdx (+460 -0)
📝 packages/better-auth/src/adapters/kysely-adapter/test/state.txt (+1 -1)
📝 packages/better-auth/src/plugins/organization/access/statement.ts (+4 -0)
📝 packages/better-auth/src/plugins/organization/client.ts (+16 -3)
📝 packages/better-auth/src/plugins/organization/has-permission.ts (+105 -9)
📝 packages/better-auth/src/plugins/organization/organization.test.ts (+21 -9)
📝 packages/better-auth/src/plugins/organization/organization.ts (+92 -9)
➕ packages/better-auth/src/plugins/organization/routes/crud-access-control.test.ts (+641 -0)
➕ packages/better-auth/src/plugins/organization/routes/crud-access-control.ts (+1377 -0)
📝 packages/better-auth/src/plugins/organization/routes/crud-invites.ts (+22 -12)
📝 packages/better-auth/src/plugins/organization/routes/crud-members.ts (+26 -14)
📝 packages/better-auth/src/plugins/organization/routes/crud-org.ts (+20 -12)
📝 packages/better-auth/src/plugins/organization/routes/crud-team.ts (+53 -30)
📝 packages/better-auth/src/plugins/organization/schema.ts (+10 -0)
📝 packages/better-auth/src/plugins/organization/types.ts (+194 -1)

📄 Description

https://github.com/better-auth/better-auth/issues/2743

image image

Summary by cubic

Add Dynamic Access Control for organizations so you can create, read, update, and delete org-specific roles at runtime, with async permission checks that include those dynamic roles. This keeps static roles working and unlocks flexible, DB-backed role management.

  • New Features

    • New organizationRole table and endpoints: create-role, delete-role, list-roles, get-role, update-role.
    • hasPermission is now async and loads dynamic roles from the DB; new clientSideHasPermission for client-only checks.
    • Added ac resource to default statements; owner/admin get create/read/update/delete; member gets read.
    • Config: dynamicAccessControl.enabled, validateRoleName, allowCreating/Updating/Deleting/Listing/GettingRole, normalizeRoleName, maximumRolesPerOrganization.
    • organizationRole supports additionalFields; infer on client via inferOrgAdditionalFields.
    • Updated org/team/invite/member routes to await hasPermission.

  • Migration

    • Run DB migration to add the organizationRole table.
    • Server: provide a shared ac instance and enable dynamicAccessControl in the organization plugin.
    • Client: enable dynamicAccessControl in organizationClient; optionally use inferOrgAdditionalFields.
    • Update code to await hasPermission and pass organizationId when available.
    • Note: checkRolePermission runs on the client and does not include dynamic roles; use hasPermission for dynamic role checks.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/4087 **Author:** [@ping-maxwell](https://github.com/ping-maxwell) **Created:** 8/19/2025 **Status:** ✅ Merged **Merged:** 8/31/2025 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `feat/org/dynamic-access-control` --- ### 📝 Commits (10+) - [`3aab358`](https://github.com/better-auth/better-auth/commit/3aab358f30e6791d13af2e96cdb8bf455f21d117) feat(org): Dynamic Access Control - [`3220968`](https://github.com/better-auth/better-auth/commit/32209687e33baf2b971276dfad4409e6e763510e) chore: lint - [`13e2544`](https://github.com/better-auth/better-auth/commit/13e254428de196fc9b8d75698266f8797f701019) fix: cubic suggestions - [`7a9ad2a`](https://github.com/better-auth/better-auth/commit/7a9ad2a0b03eaebf09f02cc99846a61773bafe49) update: code cleanup - [`be9d9b6`](https://github.com/better-auth/better-auth/commit/be9d9b68be2d7e9a91d5a80c75076cdef27485db) Merge branch 'canary' into feat/org/dynamic-access-control - [`221c276`](https://github.com/better-auth/better-auth/commit/221c27611d05c77658ff253eb2ea15ab4035f8d5) Merge branch 'canary' into feat/org/dynamic-access-control - [`25c46d2`](https://github.com/better-auth/better-auth/commit/25c46d2f5be4e5af1e952fa4cfb47550f77ea2f5) Merge branch 'canary' into feat/org/dynamic-access-control - [`67dc465`](https://github.com/better-auth/better-auth/commit/67dc4659638ed0561e7d3dffac7d80bec5cc804f) Merge branch 'canary' into feat/org/dynamic-access-control - [`78508ab`](https://github.com/better-auth/better-auth/commit/78508ab6af1e2dfce097ff91f792b816e1044fac) Update packages/better-auth/src/plugins/organization/routes/crud-access-control.ts - [`0ce66a1`](https://github.com/better-auth/better-auth/commit/0ce66a1e0a549fd7ddea0f0b349ad6c36d92788f) update: added onUpdate ### 📊 Changes **15 files changed** (+3042 additions, -100 deletions) <details> <summary>View changed files</summary> 📝 `docs/content/docs/plugins/organization.mdx` (+460 -0) 📝 `packages/better-auth/src/adapters/kysely-adapter/test/state.txt` (+1 -1) 📝 `packages/better-auth/src/plugins/organization/access/statement.ts` (+4 -0) 📝 `packages/better-auth/src/plugins/organization/client.ts` (+16 -3) 📝 `packages/better-auth/src/plugins/organization/has-permission.ts` (+105 -9) 📝 `packages/better-auth/src/plugins/organization/organization.test.ts` (+21 -9) 📝 `packages/better-auth/src/plugins/organization/organization.ts` (+92 -9) ➕ `packages/better-auth/src/plugins/organization/routes/crud-access-control.test.ts` (+641 -0) ➕ `packages/better-auth/src/plugins/organization/routes/crud-access-control.ts` (+1377 -0) 📝 `packages/better-auth/src/plugins/organization/routes/crud-invites.ts` (+22 -12) 📝 `packages/better-auth/src/plugins/organization/routes/crud-members.ts` (+26 -14) 📝 `packages/better-auth/src/plugins/organization/routes/crud-org.ts` (+20 -12) 📝 `packages/better-auth/src/plugins/organization/routes/crud-team.ts` (+53 -30) 📝 `packages/better-auth/src/plugins/organization/schema.ts` (+10 -0) 📝 `packages/better-auth/src/plugins/organization/types.ts` (+194 -1) </details> ### 📄 Description https://github.com/better-auth/better-auth/issues/2743 - [x] additional fields support - [x] tests - [x] [documentation](https://better-auth-docs-git-fork-ping-maxwell-feat-75babf-better-auth.vercel.app/docs/plugins/organization#dynamic-access-control) <img width="893" height="895" alt="image" src="https://github.com/user-attachments/assets/cae6a3ba-6acb-4ee5-b225-fc36d2cfb20c" /> <img width="293" height="585" alt="image" src="https://github.com/user-attachments/assets/1c79c296-584d-4011-bb6f-3fd5d57be81d" /> <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Add Dynamic Access Control for organizations so you can create, read, update, and delete org-specific roles at runtime, with async permission checks that include those dynamic roles. This keeps static roles working and unlocks flexible, DB-backed role management. - New Features - New organizationRole table and endpoints: create-role, delete-role, list-roles, get-role, update-role. - hasPermission is now async and loads dynamic roles from the DB; new clientSideHasPermission for client-only checks. - Added ac resource to default statements; owner/admin get create/read/update/delete; member gets read. - Config: dynamicAccessControl.enabled, validateRoleName, allowCreating/Updating/Deleting/Listing/GettingRole, normalizeRoleName, maximumRolesPerOrganization. - organizationRole supports additionalFields; infer on client via inferOrgAdditionalFields. - Updated org/team/invite/member routes to await hasPermission. - Migration - Run DB migration to add the organizationRole table. - Server: provide a shared ac instance and enable dynamicAccessControl in the organization plugin. - Client: enable dynamicAccessControl in organizationClient; optionally use inferOrgAdditionalFields. - Update code to await hasPermission and pass organizationId when available. - Note: checkRolePermission runs on the client and does not include dynamic roles; use hasPermission for dynamic role checks. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:13:07 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5179
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?