github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-15 08:25:06 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7076] [MERGED] fix(api-key): remove double stringify/parse of metadata field #7060

New Issue
Closed
opened 2026-03-13 13:22:48 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:22:48 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7076
Author: @xiaoyu2er
Created: 12/31/2025
Status: ✅ Merged
Merged: 1/10/2026
Merged by: @himself65

Base: canary ← Head: fix/api-key-metadata-double-stringify

📝 Commits (7)

  • c1061ab fix(api-key): remove double stringify/parse of metadata field
  • 67ddfd8 Merge branch 'canary' into fix/api-key-metadata-double-stringify
  • 03b46f7 feat(api-key): add automatic migration for legacy double-stringified metadata
  • 14062e0 Merge branch 'canary' into fix/api-key-metadata-double-stringify
  • 762a2a8 fix: don not export needsMetadataMigration
  • 523a7f9 Merge branch 'canary' into fix/api-key-metadata-double-stringify
  • 8341f19 fix: test

📊 Changes

7 files changed (+430 additions, -39 deletions)

View changed files

📝 packages/better-auth/src/plugins/api-key/adapter.ts (+114 -0)
📝 packages/better-auth/src/plugins/api-key/api-key.test.ts (+253 -0)
📝 packages/better-auth/src/plugins/api-key/routes/create-api-key.ts (+2 -2)
📝 packages/better-auth/src/plugins/api-key/routes/get-api-key.ts (+7 -4)
📝 packages/better-auth/src/plugins/api-key/routes/list-api-keys.ts (+19 -19)
📝 packages/better-auth/src/plugins/api-key/routes/update-api-key.ts (+13 -7)
📝 packages/better-auth/src/plugins/api-key/routes/verify-api-key.ts (+22 -7)

📄 Description

Problem

The metadata field in the API key plugin was being transformed twice:

  1. Manual stringify: schema.apikey.fields.metadata.transform.input(metadata) in the route handlers
  2. Automatic stringify: The adapter factory applies transform.input to all fields with transforms defined in the schema

This caused metadata to be double-stringified when stored:

Input: { organizationId: "abc" }
After first stringify: '{"organizationId":"abc"}'
After second stringify: '"{\\"organizationId\\":\\"abc\\"}"'

Solution

  • Remove manual transform.input calls in create-api-key.ts and update-api-key.ts
  • Remove manual transform.output calls in list-api-keys.ts, get-api-key.ts, update-api-key.ts, and verify-api-key.ts
  • Let the adapter factory handle all metadata transformations automatically

⚠️ Breaking Change

This is a breaking change for users who have existing API keys with metadata created using the buggy double-stringify behavior.

Before this fix:

  • Metadata was double-stringified on write
  • Double-parsed on read (adapter + manual transform) → returned as object ✅

After this fix:

  • Metadata is properly stringified once on write
  • Parsed once on read (adapter only) → returned as object ✅
  • However, OLD double-stringified data will only be parsed once → returned as a string instead of object ❌

Testing

All 120 API key tests pass.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7076 **Author:** [@xiaoyu2er](https://github.com/xiaoyu2er) **Created:** 12/31/2025 **Status:** ✅ Merged **Merged:** 1/10/2026 **Merged by:** [@himself65](https://github.com/himself65) **Base:** `canary` ← **Head:** `fix/api-key-metadata-double-stringify` --- ### 📝 Commits (7) - [`c1061ab`](https://github.com/better-auth/better-auth/commit/c1061ab8dced557698dcee2f6fb5f68e8232dc3f) fix(api-key): remove double stringify/parse of metadata field - [`67ddfd8`](https://github.com/better-auth/better-auth/commit/67ddfd8c07dc0ce0415b1db62481168d7c28ac0b) Merge branch 'canary' into fix/api-key-metadata-double-stringify - [`03b46f7`](https://github.com/better-auth/better-auth/commit/03b46f77785f740bfe0bfa627087abd53b3430ff) feat(api-key): add automatic migration for legacy double-stringified metadata - [`14062e0`](https://github.com/better-auth/better-auth/commit/14062e00f1baac5106e2e3aa4c89b22153a4880f) Merge branch 'canary' into fix/api-key-metadata-double-stringify - [`762a2a8`](https://github.com/better-auth/better-auth/commit/762a2a8658d9f939996c6c58d5af81f2f55dd799) fix: don not export needsMetadataMigration - [`523a7f9`](https://github.com/better-auth/better-auth/commit/523a7f99dff0ca354493965d685d8b64c34f8882) Merge branch 'canary' into fix/api-key-metadata-double-stringify - [`8341f19`](https://github.com/better-auth/better-auth/commit/8341f1976f4487fbb4252b2480bcf8443729069c) fix: test ### 📊 Changes **7 files changed** (+430 additions, -39 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/api-key/adapter.ts` (+114 -0) 📝 `packages/better-auth/src/plugins/api-key/api-key.test.ts` (+253 -0) 📝 `packages/better-auth/src/plugins/api-key/routes/create-api-key.ts` (+2 -2) 📝 `packages/better-auth/src/plugins/api-key/routes/get-api-key.ts` (+7 -4) 📝 `packages/better-auth/src/plugins/api-key/routes/list-api-keys.ts` (+19 -19) 📝 `packages/better-auth/src/plugins/api-key/routes/update-api-key.ts` (+13 -7) 📝 `packages/better-auth/src/plugins/api-key/routes/verify-api-key.ts` (+22 -7) </details> ### 📄 Description ## Problem The metadata field in the API key plugin was being transformed twice: 1. **Manual stringify**: `schema.apikey.fields.metadata.transform.input(metadata)` in the route handlers 2. **Automatic stringify**: The adapter factory applies `transform.input` to all fields with transforms defined in the schema This caused metadata to be double-stringified when stored: ``` Input: { organizationId: "abc" } After first stringify: '{"organizationId":"abc"}' After second stringify: '"{\\"organizationId\\":\\"abc\\"}"' ``` ## Solution - Remove manual `transform.input` calls in `create-api-key.ts` and `update-api-key.ts` - Remove manual `transform.output` calls in `list-api-keys.ts`, `get-api-key.ts`, `update-api-key.ts`, and `verify-api-key.ts` - Let the adapter factory handle all metadata transformations automatically ## ⚠️ Breaking Change This is a **breaking change** for users who have existing API keys with metadata created using the buggy double-stringify behavior. **Before this fix:** - Metadata was double-stringified on write - Double-parsed on read (adapter + manual transform) → returned as object ✅ **After this fix:** - Metadata is properly stringified once on write - Parsed once on read (adapter only) → returned as object ✅ - **However, OLD double-stringified data** will only be parsed once → returned as a **string** instead of object ❌ ## Testing All 120 API key tests pass. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:22:48 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7060