github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 15:42:09 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6275] [MERGED] feat(better-auth): add support for scoped endpoints #6560

New Issue
Closed
opened 2026-03-13 13:03:21 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:03:21 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6275
Author: @jonathansamines
Created: 11/24/2025
Status: ✅ Merged
Merged: 12/11/2025
Merged by: @Bekacru

Base: canary ← Head: feat/scoped-endpoints

📝 Commits (10+)

  • 5be17a9 chore(better-auth): use server scoped endpoints
  • 2fcb234 chore(better-auth): replace isAction flag for server scoped endpoints
  • c8df5a3 chore(better-auth): add scoped endpoints support
  • e6acd2d chore(better-auth): remove unnecessary client metadata property
  • 1b8b2f5 chore(better-auth): fix openapi endpoint metadata
  • a039df8 chore(better-auth): fix generic type
  • 53d5f14 chore(better-auth): fix endpoint invocation tests
  • 5db1ff4 chore(better-auth): fix linting
  • 27aa657 Merge branch 'canary' into feat/scoped-endpoints
  • fab2113 Merge branch 'canary' into feat/scoped-endpoints

📊 Changes

24 files changed (+227 additions, -77 deletions)

View changed files

📝 packages/better-auth/src/api/routes/update-user.ts (+0 -4)
📝 packages/better-auth/src/api/to-auth-endpoints.ts (+4 -1)
📝 packages/better-auth/src/call.test.ts (+37 -0)
📝 packages/better-auth/src/client/client.test.ts (+2 -0)
📝 packages/better-auth/src/client/path-to-object.ts (+6 -0)
📝 packages/better-auth/src/client/test-plugin.ts (+38 -0)
📝 packages/better-auth/src/plugins/api-key/routes/delete-all-expired-api-keys.ts (+0 -4)
📝 packages/better-auth/src/plugins/api-key/routes/verify-api-key.ts (+0 -4)
📝 packages/better-auth/src/plugins/email-otp/routes.ts (+0 -4)
📝 packages/better-auth/src/plugins/jwt/index.ts (+0 -4)
📝 packages/better-auth/src/plugins/mcp/index.ts (+3 -7)
📝 packages/better-auth/src/plugins/oidc-provider/index.ts (+5 -6)
📝 packages/better-auth/src/plugins/open-api/generator.ts (+3 -2)
📝 packages/better-auth/src/plugins/open-api/index.ts (+2 -3)
📝 packages/better-auth/src/plugins/organization/routes/crud-members.ts (+0 -2)
📝 packages/better-auth/src/plugins/two-factor/backup-codes/index.ts (+0 -4)
📝 packages/better-auth/src/plugins/two-factor/totp/index.ts (+0 -2)
📝 packages/better-auth/src/types/types.test.ts (+43 -1)
📝 packages/better-auth/src/utils/hide-metadata.ts (+2 -2)
📝 packages/core/src/api/index.ts (+62 -9)

...and 4 more files

📄 Description

What is changing?
This PR adds support for virtual and scoped endpoints, replacing all existing endpoint metadata (client, SERVER_ONLY or isAction with the respective equivalent.

Please refer to better-call docs for details about virtual and scoped endpoints.

Summary by cubic

Adds support for virtual and scoped endpoints (“server” and “http”) to better-auth. Replaces legacy SERVER_ONLY and isAction flags, improves type safety, and hides server/virtual endpoints from clients and OpenAPI; http-scoped are HTTP-only and not in the client.

  • New Features

    • Virtual endpoints: define endpoints without a path; callable via server auth.api, not exposed over HTTP, client, or OpenAPI.
    • Scoped endpoints: use metadata.scope ("server" or "http"); server-scoped appear in server auth.api; http-scoped are HTTP-only and hidden from client.
    • createAuthEndpoint now supports both path and pathless signatures; stricter types via StrictEndpoint.

  • Refactors

    • Removed paths and SERVER_ONLY from server-only endpoints across plugins; standardized on HIDE_METADATA = { scope: "server" }.
    • Replaced isAction with scoped metadata in OIDC, SCIM, SSO, Stripe, Expo, MCP, and two-factor/email-otp/jwt/totp plugins.
    • OpenAPI generator skips endpoints without a path and continues honoring disabledPaths.

Written for commit f328def3e2. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6275 **Author:** [@jonathansamines](https://github.com/jonathansamines) **Created:** 11/24/2025 **Status:** ✅ Merged **Merged:** 12/11/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `feat/scoped-endpoints` --- ### 📝 Commits (10+) - [`5be17a9`](https://github.com/better-auth/better-auth/commit/5be17a993761e96474eb55f870bcb5d2f4ea68d9) chore(better-auth): use server scoped endpoints - [`2fcb234`](https://github.com/better-auth/better-auth/commit/2fcb23429fef97784d17123c71abe86bfe2704fe) chore(better-auth): replace isAction flag for server scoped endpoints - [`c8df5a3`](https://github.com/better-auth/better-auth/commit/c8df5a3935e99fcac569c3b4887f052f0b80f95a) chore(better-auth): add scoped endpoints support - [`e6acd2d`](https://github.com/better-auth/better-auth/commit/e6acd2d959cd50dec8c4e87ccb322710ce6ff186) chore(better-auth): remove unnecessary client metadata property - [`1b8b2f5`](https://github.com/better-auth/better-auth/commit/1b8b2f54e488c20a5a25016e904c10625ac361e7) chore(better-auth): fix openapi endpoint metadata - [`a039df8`](https://github.com/better-auth/better-auth/commit/a039df8c7930531c7b5a6885b9855ffa6d2a72cf) chore(better-auth): fix generic type - [`53d5f14`](https://github.com/better-auth/better-auth/commit/53d5f14eac3db56dd7d6a4df5ea8545754af3ec0) chore(better-auth): fix endpoint invocation tests - [`5db1ff4`](https://github.com/better-auth/better-auth/commit/5db1ff4d04eeb8afcab99dc84b3d96555e57a94e) chore(better-auth): fix linting - [`27aa657`](https://github.com/better-auth/better-auth/commit/27aa65724f448b6d9627dda2b22cd1128edbe1a2) Merge branch 'canary' into feat/scoped-endpoints - [`fab2113`](https://github.com/better-auth/better-auth/commit/fab21136fa9c37bbfccee6dde8f54004d5a258e8) Merge branch 'canary' into feat/scoped-endpoints ### 📊 Changes **24 files changed** (+227 additions, -77 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/api/routes/update-user.ts` (+0 -4) 📝 `packages/better-auth/src/api/to-auth-endpoints.ts` (+4 -1) 📝 `packages/better-auth/src/call.test.ts` (+37 -0) 📝 `packages/better-auth/src/client/client.test.ts` (+2 -0) 📝 `packages/better-auth/src/client/path-to-object.ts` (+6 -0) 📝 `packages/better-auth/src/client/test-plugin.ts` (+38 -0) 📝 `packages/better-auth/src/plugins/api-key/routes/delete-all-expired-api-keys.ts` (+0 -4) 📝 `packages/better-auth/src/plugins/api-key/routes/verify-api-key.ts` (+0 -4) 📝 `packages/better-auth/src/plugins/email-otp/routes.ts` (+0 -4) 📝 `packages/better-auth/src/plugins/jwt/index.ts` (+0 -4) 📝 `packages/better-auth/src/plugins/mcp/index.ts` (+3 -7) 📝 `packages/better-auth/src/plugins/oidc-provider/index.ts` (+5 -6) 📝 `packages/better-auth/src/plugins/open-api/generator.ts` (+3 -2) 📝 `packages/better-auth/src/plugins/open-api/index.ts` (+2 -3) 📝 `packages/better-auth/src/plugins/organization/routes/crud-members.ts` (+0 -2) 📝 `packages/better-auth/src/plugins/two-factor/backup-codes/index.ts` (+0 -4) 📝 `packages/better-auth/src/plugins/two-factor/totp/index.ts` (+0 -2) 📝 `packages/better-auth/src/types/types.test.ts` (+43 -1) 📝 `packages/better-auth/src/utils/hide-metadata.ts` (+2 -2) 📝 `packages/core/src/api/index.ts` (+62 -9) _...and 4 more files_ </details> ### 📄 Description **What is changing?** This PR adds support for [virtual and scoped endpoints](https://github.com/Bekacru/better-call?tab=readme-ov-file#virtual-endpoints), replacing all existing endpoint metadata (`client`, `SERVER_ONLY` or `isAction` with the respective equivalent. Please refer to [better-call docs](https://github.com/Bekacru/better-call?tab=readme-ov-file#virtual-endpoints) for details about virtual and scoped endpoints. <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds support for virtual and scoped endpoints (“server” and “http”) to better-auth. Replaces legacy SERVER_ONLY and isAction flags, improves type safety, and hides server/virtual endpoints from clients and OpenAPI; http-scoped are HTTP-only and not in the client. - **New Features** - Virtual endpoints: define endpoints without a path; callable via server auth.api, not exposed over HTTP, client, or OpenAPI. - Scoped endpoints: use metadata.scope ("server" or "http"); server-scoped appear in server auth.api; http-scoped are HTTP-only and hidden from client. - createAuthEndpoint now supports both path and pathless signatures; stricter types via StrictEndpoint. - **Refactors** - Removed paths and SERVER_ONLY from server-only endpoints across plugins; standardized on HIDE_METADATA = { scope: "server" }. - Replaced isAction with scoped metadata in OIDC, SCIM, SSO, Stripe, Expo, MCP, and two-factor/email-otp/jwt/totp plugins. - OpenAPI generator skips endpoints without a path and continues honoring disabledPaths. <sup>Written for commit f328def3e2ae976b029cc6a64315fdb541679da9. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:03:21 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#6560
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?