github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 14:21:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #7945] feat: add customizable password validation hook #7644

New Issue
Open
opened 2026-03-13 13:44:11 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:44:11 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7945
Author: @DanielvG-IT
Created: 2/12/2026
Status: 🔄 Open

Base: canary ← Head: password-validation

📝 Commits (5)

  • 6601f7b Add customizable password validation hook
  • 5f92627 fix: enforce sync password validator and expand policy coverage
  • fd5b5e1 test: type admin client in password validation coverage
  • 5f5a8ec test: keep custom password validator coverage setup-compatible
  • 6579eab test: align admin fixtures with enforced password policy

📊 Changes

18 files changed (+312 additions, -87 deletions)

View changed files

📝 packages/better-auth/src/api/routes/password.test.ts (+76 -0)
📝 packages/better-auth/src/api/routes/password.ts (+2 -10)
📝 packages/better-auth/src/api/routes/sign-up.test.ts (+27 -0)
📝 packages/better-auth/src/api/routes/sign-up.ts (+2 -16)
📝 packages/better-auth/src/api/routes/update-user.test.ts (+26 -0)
📝 packages/better-auth/src/api/routes/update-user.ts (+3 -24)
📝 packages/better-auth/src/context/create-context.test.ts (+11 -1)
📝 packages/better-auth/src/context/create-context.ts (+1 -0)
📝 packages/better-auth/src/plugins/admin/admin.test.ts (+67 -10)
📝 packages/better-auth/src/plugins/admin/routes.ts (+3 -10)
📝 packages/better-auth/src/plugins/email-otp/email-otp.test.ts (+44 -0)
📝 packages/better-auth/src/plugins/email-otp/routes.ts (+2 -8)
📝 packages/better-auth/src/plugins/phone-number/routes.ts (+2 -8)
📝 packages/better-auth/src/utils/password.ts (+36 -0)
📝 packages/core/src/error/codes.ts (+1 -0)
📝 packages/core/src/types/context.ts (+1 -0)
📝 packages/core/src/types/init-options.ts (+7 -0)
📝 packages/telemetry/src/detectors/detect-auth-config.ts (+1 -0)

📄 Description

Summary

  • add support for a single custom password validation function via emailAndPassword.password.validate
  • keep existing built-in min/max password length checks
  • centralize password policy enforcement through assertPasswordPolicy across password-related flows
  • return PASSWORD_DOES_NOT_MATCH_REQUIREMENTS when custom validation fails

Why this approach

This follows maintainer feedback from #2543:

  • avoid adding many new password-complexity config flags
  • prefer one extensible function hook

Behavior

  • built-in checks run first: minPasswordLength and maxPasswordLength
  • if provided, emailAndPassword.password.validate(password) runs next
  • on custom validation failure, API returns PASSWORD_DOES_NOT_MATCH_REQUIREMENTS

Scope

Applied consistently to:

  • sign-up
  • reset password
  • change/set password
  • admin set-user-password
  • email-otp reset password
  • phone-number re

Summrd

Closes #2484

Summary by cubic

Add a customizable, sync-only password validation hook and enforce one password policy across all flows (sign-up; change/reset/set password; admin createUser/setUserPassword; email/phone OTP resets). Custom rules run after min/max length; async validators are rejected with clear errors.

  • New Features

    • Added emailAndPassword.password.validate(password) hook (sync boolean).
    • Returns PASSWORD_DOES_NOT_MATCH_REQUIREMENTS on custom validation failure; ASYNC_VALIDATION_NOT_SUPPORTED for async validators.

  • Refactors

    • Centralized checks via assertPasswordPolicy across all password flows, including admin createUser/setUserPassword and email/phone OTP resets.
    • Exposed validate in context/types and telemetry; removed inline length checks.

Written for commit 6579eabd18. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7945 **Author:** [@DanielvG-IT](https://github.com/DanielvG-IT) **Created:** 2/12/2026 **Status:** 🔄 Open **Base:** `canary` ← **Head:** `password-validation` --- ### 📝 Commits (5) - [`6601f7b`](https://github.com/better-auth/better-auth/commit/6601f7b4b84062bb42dd0dcd3a510fe131b86aba) Add customizable password validation hook - [`5f92627`](https://github.com/better-auth/better-auth/commit/5f9262731b5914966df15094fe4ce0fbe48191b2) fix: enforce sync password validator and expand policy coverage - [`fd5b5e1`](https://github.com/better-auth/better-auth/commit/fd5b5e1885f8a85ebc1e0c1b183bb351db5c3b28) test: type admin client in password validation coverage - [`5f5a8ec`](https://github.com/better-auth/better-auth/commit/5f5a8ecd7df8a3fe61127dff7247e0887f6fa191) test: keep custom password validator coverage setup-compatible - [`6579eab`](https://github.com/better-auth/better-auth/commit/6579eabd1867f8347d28e26d3ae29e683ac814b3) test: align admin fixtures with enforced password policy ### 📊 Changes **18 files changed** (+312 additions, -87 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/api/routes/password.test.ts` (+76 -0) 📝 `packages/better-auth/src/api/routes/password.ts` (+2 -10) 📝 `packages/better-auth/src/api/routes/sign-up.test.ts` (+27 -0) 📝 `packages/better-auth/src/api/routes/sign-up.ts` (+2 -16) 📝 `packages/better-auth/src/api/routes/update-user.test.ts` (+26 -0) 📝 `packages/better-auth/src/api/routes/update-user.ts` (+3 -24) 📝 `packages/better-auth/src/context/create-context.test.ts` (+11 -1) 📝 `packages/better-auth/src/context/create-context.ts` (+1 -0) 📝 `packages/better-auth/src/plugins/admin/admin.test.ts` (+67 -10) 📝 `packages/better-auth/src/plugins/admin/routes.ts` (+3 -10) 📝 `packages/better-auth/src/plugins/email-otp/email-otp.test.ts` (+44 -0) 📝 `packages/better-auth/src/plugins/email-otp/routes.ts` (+2 -8) 📝 `packages/better-auth/src/plugins/phone-number/routes.ts` (+2 -8) 📝 `packages/better-auth/src/utils/password.ts` (+36 -0) 📝 `packages/core/src/error/codes.ts` (+1 -0) 📝 `packages/core/src/types/context.ts` (+1 -0) 📝 `packages/core/src/types/init-options.ts` (+7 -0) 📝 `packages/telemetry/src/detectors/detect-auth-config.ts` (+1 -0) </details> ### 📄 Description ## Summary - add support for a single custom password validation function via `emailAndPassword.password.validate` - keep existing built-in min/max password length checks - centralize password policy enforcement through `assertPasswordPolicy` across password-related flows - return `PASSWORD_DOES_NOT_MATCH_REQUIREMENTS` when custom validation fails ## Why this approach This follows maintainer feedback from [#2543](https://github.com/better-auth/better-auth/pull/2543): - avoid adding many new password-complexity config flags - prefer one extensible function hook ## Behavior - built-in checks run first: `minPasswordLength` and `maxPasswordLength` - if provided, `emailAndPassword.password.validate(password)` runs next - on custom validation failure, API returns `PASSWORD_DOES_NOT_MATCH_REQUIREMENTS` ## Scope Applied consistently to: - sign-up - reset password - change/set password - admin set-user-password - email-otp reset password - phone-number re ## Summrd Closes #2484 <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Add a customizable, sync-only password validation hook and enforce one password policy across all flows (sign-up; change/reset/set password; admin createUser/setUserPassword; email/phone OTP resets). Custom rules run after min/max length; async validators are rejected with clear errors. - **New Features** - Added emailAndPassword.password.validate(password) hook (sync boolean). - Returns PASSWORD_DOES_NOT_MATCH_REQUIREMENTS on custom validation failure; ASYNC_VALIDATION_NOT_SUPPORTED for async validators. - **Refactors** - Centralized checks via assertPasswordPolicy across all password flows, including admin createUser/setUserPassword and email/phone OTP resets. - Exposed validate in context/types and telemetry; removed inline length checks. <sup>Written for commit 6579eabd1867f8347d28e26d3ae29e683ac814b3. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:44:11 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7644
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?