github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-28 14:45:40 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #8419] [CLOSED] Add graph-based permission system and assets plugin #7961

New Issue
Closed
opened 2026-03-13 13:54:42 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 13:54:42 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/8419
Author: @nksaraf
Created: 3/5/2026
Status: ❌ Closed

Base: canary ← Head: claude/analyze-upstream-plugins-AfOOj

📝 Commits (10+)

  • 8a8171f remove other demos
  • 10d6475 add helpful adapter name and id for drizzle transaction adapter
  • 028e9ca move back to pnpm@8, use pnpm overrides instead of catalog dependencies, remove prisma and other adapters from better-auth
  • 5c509ab add a graph adapter and context to handle objects and relationships
  • bc9a301 export crypto utils like password hashing from better-auth entrypoint
  • a933bd9 add a runWithGraphTransaction method
  • 471e8e2 add graph config to auth init types
  • 33618b4 use runWithGraphTransaction
  • d6745a1 add authzed adapter as default graph adapter
  • 87b975d use runWithGraphTransaction for sign up route

📊 Changes

1614 files changed (+263077 additions, -77114 deletions)

View changed files

➕ .claude/agents/cherry-pick-release.md (+184 -0)
➕ .claude/rules/release.md (+123 -0)
➕ .cspell.jsonc (+103 -0)
➕ .cspell/alt-languages.txt (+11 -0)
➕ .cspell/auth-terms.txt (+32 -0)
➕ .cspell/company-names.txt (+29 -0)
➕ .cspell/custom-words.txt (+17 -0)
➕ .cspell/misspelled.txt (+4 -0)
➕ .cspell/names.txt (+29 -0)
➕ .cspell/tech-terms.txt (+50 -0)
➕ .cspell/third-party.txt (+41 -0)
📝 .github/ISSUE_TEMPLATE/bug_report.yml (+1 -1)
➕ .github/actions/setup-playwright/action.yml (+68 -0)
➖ .github/workflows/adapter-tests.yml (+0 -67)
➖ .github/workflows/cherry-pick-to-main.yml (+0 -325)
📝 .github/workflows/ci.yml (+74 -43)
➕ .github/workflows/claude.yml (+53 -0)
➕ .github/workflows/demo.yml (+56 -0)
📝 .github/workflows/e2e.yml (+92 -44)
➕ .github/workflows/npm-dist-tag.yml (+35 -0)

...and 80 more files

📄 Description

Summary

This PR introduces a comprehensive graph-based permission system for Better Auth using SpiceDB/Authzed, along with a new assets plugin for granular access control. It also includes significant refactoring of the organization plugin and removal of demo applications.

Key Changes

Graph Permission System

  • Added graph-context.ts for managing graph-based permissions and relationships
  • Implemented authzed-adapter.ts for SpiceDB/Authzed integration
  • Generated type-safe permission operations via generated/graph.ts from SpiceDB schema
  • Added scripts/authzed.ts for schema parsing and code generation

Assets Plugin

  • New standalone assets plugin with granular access control
  • Supports asset types, roles, and visibility levels (private/internal/public)
  • Includes adapter layer for database operations
  • Provides client-side API for asset management

Agents Plugin

  • New agents plugin with CRUD operations
  • Includes error codes, schemas, and client utilities
  • Supports agent creation, deletion, and listing

Organization Plugin Refactoring

  • Removed inbuilt access control (access/ directory)
  • Removed dynamic access control routes (crud-access-control.ts)
  • Simplified member and team management
  • Updated schema and types for cleaner API

Core Infrastructure Updates

  • Enhanced BetterAuthOptions with graph context support
  • Updated adapter factory with new graph-related methods
  • Modified internal adapter to support graph operations
  • Added graph context to endpoint and transaction contexts

Documentation

  • Added comprehensive PLUGIN_DEVELOPMENT_GUIDE.md with plugin structure patterns
  • Added REFACTORING_PLAN.md detailing organization plugin changes
  • Added ASSET_IMPLEMENTATION_PLAN.md for asset plugin design
  • Added PLAN_REVIEW.md and JUNCTION_TABLE_ANALYSIS.md for architectural decisions

Demo Application Cleanup

  • Removed Next.js demo application (all files under demo/nextjs/)
  • Removed Expo demo application (all files under demo/expo/)
  • Removed stateless demo application (all files under demo/stateless/)

Notable Implementation Details

  • Graph permissions use SpiceDB's Zed schema language for declarative access control
  • Assets plugin is designed as a separate plugin that integrates with organization plugin when both enabled
  • Asset roles are scoped to asset types rather than individual assets to prevent role explosion
  • New error handling utilities added for consistent error management across plugins

https://claude.ai/code/session_01RztpoNz3hFPj5rXwcnRcca

Summary by cubic

Switches graph authorization and agents to external plugins built on the public Better Auth API and resets the core to upstream canary. Adds an Electron demo and updates Next.js/Expo demos and CI/release tooling.

  • New Features

    • External plugin-graph: CRUD for objects/relationships with outbox-based SpiceDB/Authzed sync.
    • External plugin-agents: CRUD with ownership checks via adapter API.
    • Demos: new Electron app; Next.js adds device approval/denial and OAuth consent + account/org selection; Expo demo refreshed.
    • CI/Docs: updated workflows (CI/e2e/release/preview), npm dist-tag tool, spellcheck/remark configs, and contributor docs.

  • Migration

    • Core reverted to upstream canary—remove usage of fork-only graph/org/admin changes and install/enable plugin-graph and plugin-agents; run their DB migrations.
    • Assets plugin is dropped from this PR.
    • Adopt Node 24 (.nvmrc) and update environment variables in demo/nextjs as needed.

Written for commit 743c95c374. Summary will update on new commits.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/8419 **Author:** [@nksaraf](https://github.com/nksaraf) **Created:** 3/5/2026 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `claude/analyze-upstream-plugins-AfOOj` --- ### 📝 Commits (10+) - [`8a8171f`](https://github.com/better-auth/better-auth/commit/8a8171fab6715fc55f275fcf53fa88e86035785f) remove other demos - [`10d6475`](https://github.com/better-auth/better-auth/commit/10d647500a0044af3a0dd73848fc6c4eb13da828) add helpful adapter name and id for drizzle transaction adapter - [`028e9ca`](https://github.com/better-auth/better-auth/commit/028e9ca0cca37cab720d4a182db5e165f56f24f0) move back to pnpm@8, use pnpm overrides instead of catalog dependencies, remove prisma and other adapters from better-auth - [`5c509ab`](https://github.com/better-auth/better-auth/commit/5c509abfcc07b655e48366c46e1d9eb73926ded8) add a graph adapter and context to handle objects and relationships - [`bc9a301`](https://github.com/better-auth/better-auth/commit/bc9a301a66a962b960b8f6f5d0368ea01189697d) export crypto utils like password hashing from better-auth entrypoint - [`a933bd9`](https://github.com/better-auth/better-auth/commit/a933bd98f9b5442af80eabb1e1d92940827204de) add a runWithGraphTransaction method - [`471e8e2`](https://github.com/better-auth/better-auth/commit/471e8e286c620ce47de10a33129e75ab24f563e0) add graph config to auth init types - [`33618b4`](https://github.com/better-auth/better-auth/commit/33618b4d9682be06371014cfebcb67137bd1eefa) use runWithGraphTransaction - [`d6745a1`](https://github.com/better-auth/better-auth/commit/d6745a131f91e9f6e3cfea758ccbd87cb734ee8a) add authzed adapter as default graph adapter - [`87b975d`](https://github.com/better-auth/better-auth/commit/87b975deb1d55482a01801bd0d4b90471fc26a99) use runWithGraphTransaction for sign up route ### 📊 Changes **1614 files changed** (+263077 additions, -77114 deletions) <details> <summary>View changed files</summary> ➕ `.claude/agents/cherry-pick-release.md` (+184 -0) ➕ `.claude/rules/release.md` (+123 -0) ➕ `.cspell.jsonc` (+103 -0) ➕ `.cspell/alt-languages.txt` (+11 -0) ➕ `.cspell/auth-terms.txt` (+32 -0) ➕ `.cspell/company-names.txt` (+29 -0) ➕ `.cspell/custom-words.txt` (+17 -0) ➕ `.cspell/misspelled.txt` (+4 -0) ➕ `.cspell/names.txt` (+29 -0) ➕ `.cspell/tech-terms.txt` (+50 -0) ➕ `.cspell/third-party.txt` (+41 -0) 📝 `.github/ISSUE_TEMPLATE/bug_report.yml` (+1 -1) ➕ `.github/actions/setup-playwright/action.yml` (+68 -0) ➖ `.github/workflows/adapter-tests.yml` (+0 -67) ➖ `.github/workflows/cherry-pick-to-main.yml` (+0 -325) 📝 `.github/workflows/ci.yml` (+74 -43) ➕ `.github/workflows/claude.yml` (+53 -0) ➕ `.github/workflows/demo.yml` (+56 -0) 📝 `.github/workflows/e2e.yml` (+92 -44) ➕ `.github/workflows/npm-dist-tag.yml` (+35 -0) _...and 80 more files_ </details> ### 📄 Description ## Summary This PR introduces a comprehensive graph-based permission system for Better Auth using SpiceDB/Authzed, along with a new assets plugin for granular access control. It also includes significant refactoring of the organization plugin and removal of demo applications. ## Key Changes ### Graph Permission System - Added `graph-context.ts` for managing graph-based permissions and relationships - Implemented `authzed-adapter.ts` for SpiceDB/Authzed integration - Generated type-safe permission operations via `generated/graph.ts` from SpiceDB schema - Added `scripts/authzed.ts` for schema parsing and code generation ### Assets Plugin - New standalone `assets` plugin with granular access control - Supports asset types, roles, and visibility levels (private/internal/public) - Includes adapter layer for database operations - Provides client-side API for asset management ### Agents Plugin - New `agents` plugin with CRUD operations - Includes error codes, schemas, and client utilities - Supports agent creation, deletion, and listing ### Organization Plugin Refactoring - Removed inbuilt access control (`access/` directory) - Removed dynamic access control routes (`crud-access-control.ts`) - Simplified member and team management - Updated schema and types for cleaner API ### Core Infrastructure Updates - Enhanced `BetterAuthOptions` with graph context support - Updated adapter factory with new graph-related methods - Modified internal adapter to support graph operations - Added graph context to endpoint and transaction contexts ### Documentation - Added comprehensive `PLUGIN_DEVELOPMENT_GUIDE.md` with plugin structure patterns - Added `REFACTORING_PLAN.md` detailing organization plugin changes - Added `ASSET_IMPLEMENTATION_PLAN.md` for asset plugin design - Added `PLAN_REVIEW.md` and `JUNCTION_TABLE_ANALYSIS.md` for architectural decisions ### Demo Application Cleanup - Removed Next.js demo application (all files under `demo/nextjs/`) - Removed Expo demo application (all files under `demo/expo/`) - Removed stateless demo application (all files under `demo/stateless/`) ## Notable Implementation Details - Graph permissions use SpiceDB's Zed schema language for declarative access control - Assets plugin is designed as a separate plugin that integrates with organization plugin when both enabled - Asset roles are scoped to asset types rather than individual assets to prevent role explosion - New error handling utilities added for consistent error management across plugins https://claude.ai/code/session_01RztpoNz3hFPj5rXwcnRcca <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Switches graph authorization and agents to external plugins built on the public Better Auth API and resets the core to upstream canary. Adds an Electron demo and updates Next.js/Expo demos and CI/release tooling. - **New Features** - External plugin-graph: CRUD for objects/relationships with outbox-based SpiceDB/Authzed sync. - External plugin-agents: CRUD with ownership checks via adapter API. - Demos: new Electron app; Next.js adds device approval/denial and OAuth consent + account/org selection; Expo demo refreshed. - CI/Docs: updated workflows (CI/e2e/release/preview), npm dist-tag tool, spellcheck/remark configs, and contributor docs. - **Migration** - Core reverted to upstream canary—remove usage of fork-only graph/org/admin changes and install/enable plugin-graph and plugin-agents; run their DB migrations. - Assets plugin is dropped from this PR. - Adopt Node 24 (.nvmrc) and update environment variables in demo/nextjs as needed. <sup>Written for commit 743c95c374c81ed7c39eecf54775960241ad392d. Summary will update on new commits.</sup> <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 13:54:42 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#7961