[PR #7960] [CLOSED] fix(oauth-provider): improve allowed paths for oauth_query for client plugin #7654

New Issue

GiteaMirror · 2026-03-13T13:44:32-05:00

GiteaMirror commented

2026-03-13 13:44:32 -05:00

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/7960
Author: @dvanmali
Created: 2/13/2026
Status: ❌ Closed

Base: canary ← Head: opClientPaths

📝 Commits (2)

7ac3114 fix: open oauth_query to more endpoints
7652b07 feat: post login test only

📊 Changes

2 files changed (+95 additions, -33 deletions)

View changed files

📝 packages/oauth-provider/src/client.ts (+4 -14)
📝 packages/oauth-provider/src/oauth.test.ts (+91 -19)

📄 Description

Better design for oauth_query by removing client pathname requirement. Adds test to separate postLogin via /continue scenarios from organization setting example.

Breaking: Cookie setting on other endpoints cause authorize flow earlier (intentional) preventing the need to request from the continue endpoint.

Discussion: Discord
Linking: #7558

Summary by cubic

Expand oauth_query injection in the client plugin to all non-GET/DELETE requests when window.location.search is present, enabling earlier authorization and reducing reliance on /oauth2/continue. Adds a focused post-login via /continue test and separates it from organization selection flows.

Bug Fixes
- Removed path checks; now injects oauth_query for any non-GET/DELETE request with a query string.
- Added a standalone post-login via /oauth2/continue test; organization selection now reads redirect Location headers with a selectedPostLogin guard.
- Tests updated to assert using response.url and Location headers where needed.
Migration
- Calling /oauth2/continue to pass oauth_query is usually no longer needed; the client auto-sends it on state-changing endpoints.
- Keep /oauth2/continue for explicit post-login continuation only. Ensure the client plugin runs on post-login endpoints and remove path-based assumptions.

^{Written for commit 7652b071bc. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/7960 **Author:** [@dvanmali](https://github.com/dvanmali) **Created:** 2/13/2026 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `opClientPaths` --- ### 📝 Commits (2) - [`7ac3114`](https://github.com/better-auth/better-auth/commit/7ac311408e8dbe9c82c761c1c47149c6efa42db6) fix: open oauth_query to more endpoints - [`7652b07`](https://github.com/better-auth/better-auth/commit/7652b071bcd8e71c1964466c7438a839da145234) feat: post login test only ### 📊 Changes **2 files changed** (+95 additions, -33 deletions) <details> <summary>View changed files</summary> 📝 `packages/oauth-provider/src/client.ts` (+4 -14) 📝 `packages/oauth-provider/src/oauth.test.ts` (+91 -19) </details> ### 📄 Description Better design for `oauth_query` by removing client pathname requirement. Adds test to separate `postLogin` via `/continue` scenarios from `organization` setting example. _Breaking_: Cookie setting on other endpoints cause authorize flow earlier (intentional) preventing the need to request from the `continue` endpoint. Discussion: [Discord](https://discord.com/channels/1288403910284935179/1470905432573743105) Linking: #7558  --- ## Summary by cubic Expand oauth_query injection in the client plugin to all non-GET/DELETE requests when window.location.search is present, enabling earlier authorization and reducing reliance on /oauth2/continue. Adds a focused post-login via /continue test and separates it from organization selection flows. - **Bug Fixes** - Removed path checks; now injects oauth_query for any non-GET/DELETE request with a query string. - Added a standalone post-login via /oauth2/continue test; organization selection now reads redirect Location headers with a selectedPostLogin guard. - Tests updated to assert using response.url and Location headers where needed. - **Migration** - Calling /oauth2/continue to pass oauth_query is usually no longer needed; the client auto-sends it on state-changing endpoints. - Keep /oauth2/continue for explicit post-login continuation only. Ensure the client plugin runs on post-login endpoints and remove path-based assumptions. <sup>Written for commit 7652b071bcd8e71c1964466c7438a839da145234. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-03-13 13:44:32 -05:00

GiteaMirror closed this issue