github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #6699] [MERGED] feat(admin): add support role with permissions for user updates and enforce role change validation #6833

New Issue
Closed
opened 2026-03-13 13:13:14 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:13:14 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/6699
Author: @Bekacru
Created: 12/11/2025
Status: ✅ Merged
Merged: 12/11/2025
Merged by: @Bekacru

Base: canary ← Head: fix/admin-role

📝 Commits (8)

  • 805f930 feat: add support role with permissions for user updates and enforce role change validation
  • 91df830 feat: enforce subscription ownership validation in upgrade, cancel, and restore operations
  • 73826de lint
  • 0ab34f3 Update packages/better-auth/src/plugins/admin/routes.ts
  • 687b364 test: add role validation tests for update-user functionality
  • 4c883c3 feat: enhance session listing by omitting token and formatting date fields
  • a0103d6 fix type
  • 852105d lint

📊 Changes

6 files changed (+279 additions, -9 deletions)

View changed files

📝 packages/better-auth/src/api/routes/session.ts (+16 -4)
📝 packages/better-auth/src/plugins/admin/admin.test.ts (+112 -0)
📝 packages/better-auth/src/plugins/admin/error-codes.ts (+1 -0)
📝 packages/better-auth/src/plugins/admin/routes.ts (+35 -2)
📝 packages/stripe/src/routes.ts (+29 -3)
📝 packages/stripe/src/stripe.test.ts (+86 -0)

📄 Description

Summary by cubic

Adds a Support role with update permissions and secures role changes by requiring the user:set-role permission. Also blocks cross-user subscription actions by validating subscription ownership in upgrade, cancel, and restore.

  • New Features

    • Support role with user:update and order:update; role changes require user:set-role and valid roles (parseRoles runs after validation).
    • Session list omits token and returns ISO date strings for timestamps.

  • Bug Fixes

    • Validate subscriptionId belongs to the current referenceId in upgrade/cancel/restore; reject mismatches as "Subscription not found" without calling Stripe.

Written for commit 852105d843. Summary will update automatically on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/6699 **Author:** [@Bekacru](https://github.com/Bekacru) **Created:** 12/11/2025 **Status:** ✅ Merged **Merged:** 12/11/2025 **Merged by:** [@Bekacru](https://github.com/Bekacru) **Base:** `canary` ← **Head:** `fix/admin-role` --- ### 📝 Commits (8) - [`805f930`](https://github.com/better-auth/better-auth/commit/805f93017eb3bd395686764a3b4b96ee7a9d1525) feat: add support role with permissions for user updates and enforce role change validation - [`91df830`](https://github.com/better-auth/better-auth/commit/91df830f6ac4e20c5bc5171f4f946032559c3697) feat: enforce subscription ownership validation in upgrade, cancel, and restore operations - [`73826de`](https://github.com/better-auth/better-auth/commit/73826de6fb05c4092b6f57abaafecd81bd996010) lint - [`0ab34f3`](https://github.com/better-auth/better-auth/commit/0ab34f3902395807701082fcefcb592de19564ea) Update packages/better-auth/src/plugins/admin/routes.ts - [`687b364`](https://github.com/better-auth/better-auth/commit/687b364c85539f8b85f9ef924f0803283d546e55) test: add role validation tests for update-user functionality - [`4c883c3`](https://github.com/better-auth/better-auth/commit/4c883c3984463d40b2874c9e2e6759dbfe65c163) feat: enhance session listing by omitting token and formatting date fields - [`a0103d6`](https://github.com/better-auth/better-auth/commit/a0103d618bbe57a328b5d30c8d1302e264cb4684) fix type - [`852105d`](https://github.com/better-auth/better-auth/commit/852105d84327ca881d7a3537dfab19b897d89ac0) lint ### 📊 Changes **6 files changed** (+279 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/api/routes/session.ts` (+16 -4) 📝 `packages/better-auth/src/plugins/admin/admin.test.ts` (+112 -0) 📝 `packages/better-auth/src/plugins/admin/error-codes.ts` (+1 -0) 📝 `packages/better-auth/src/plugins/admin/routes.ts` (+35 -2) 📝 `packages/stripe/src/routes.ts` (+29 -3) 📝 `packages/stripe/src/stripe.test.ts` (+86 -0) </details> ### 📄 Description <!-- This is an auto-generated description by cubic. --> ## Summary by cubic Adds a Support role with update permissions and secures role changes by requiring the user:set-role permission. Also blocks cross-user subscription actions by validating subscription ownership in upgrade, cancel, and restore. - **New Features** - Support role with user:update and order:update; role changes require user:set-role and valid roles (parseRoles runs after validation). - Session list omits token and returns ISO date strings for timestamps. - **Bug Fixes** - Validate subscriptionId belongs to the current referenceId in upgrade/cancel/restore; reject mismatches as "Subscription not found" without calling Stripe. <sup>Written for commit 852105d84327ca881d7a3537dfab19b897d89ac0. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:13:14 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#6833
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?