github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

auth.api.userHasPermission method does throw error if no user is provided #863

New Issue
Closed
opened 2026-03-13 08:07:35 -05:00 by GiteaMirror · 5 comments
GiteaMirror commented 2026-03-13 08:07:35 -05:00
Owner
Copy Link

Originally created by @jonaspm on GitHub (Mar 17, 2025).

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

Docs mention that userHasPermission can get userId or role but the following code throws error:

await auth.api.userHasPermission({
    body: {
        role,
        permission: { raffle: [action] },
    },
});

error:

Image

Current vs. Expected behavior

current behaviour: execution error
expected behaviour: permissioncheck result

What version of Better Auth are you using?

1.2.4

Provide environment information

- OS: Windows 11 x64 
- Browser: Firefox v136.0.1
- Runtime: Bun

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  plugins: [
      adminPlugin({
          ac: ac,
          roles: {
              admin,
              user
          }
      }),
  ]
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

permissions.ts

import { createAccessControl } from "better-auth/plugins/access";
import { defaultStatements, adminAc } from "better-auth/plugins/admin/access";

const customDefaultStatements = Object.freeze({
    user: Array.from(new Set([...defaultStatements.user, "update"])),
    session: defaultStatements.session,
});

const statement = {
    ...customDefaultStatements, 
    raffle: [ "create", "list", "update", "delete" ],
} as const;
 
export const ac = createAccessControl(statement);
 
export const admin = ac.newRole({
    raffle: [ "create", "update", "delete", "list" ],
    ...adminAc.statements, 
});

export const user = ac.newRole({
    raffle: [ "create", "update", "delete", "list" ],
    user: [ "update", "list" ],
});
```
Originally created by @jonaspm on GitHub (Mar 17, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce Docs mention that userHasPermission can get userId or role but the following code throws error: ```javascript await auth.api.userHasPermission({ body: { role, permission: { raffle: [action] }, }, }); ``` error: ![Image](https://github.com/user-attachments/assets/028cea87-4a16-4d97-8fcb-127ca0182c5b) ### Current vs. Expected behavior current behaviour: execution error expected behaviour: permissioncheck result ### What version of Better Auth are you using? 1.2.4 ### Provide environment information ```bash - OS: Windows 11 x64 - Browser: Firefox v136.0.1 - Runtime: Bun ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ plugins: [ adminPlugin({ ac: ac, roles: { admin, user } }), ] emailAndPassword: { enabled: true }, }); ``` ### Additional context permissions.ts ````javascript import { createAccessControl } from "better-auth/plugins/access"; import { defaultStatements, adminAc } from "better-auth/plugins/admin/access"; const customDefaultStatements = Object.freeze({ user: Array.from(new Set([...defaultStatements.user, "update"])), session: defaultStatements.session, }); const statement = { ...customDefaultStatements, raffle: [ "create", "list", "update", "delete" ], } as const; export const ac = createAccessControl(statement); export const admin = ac.newRole({ raffle: [ "create", "update", "delete", "list" ], ...adminAc.statements, }); export const user = ac.newRole({ raffle: [ "create", "update", "delete", "list" ], user: [ "update", "list" ], }); ```
GiteaMirror added the bug label 2026-03-13 08:07:35 -05:00
GiteaMirror commented 2026-03-13 08:07:37 -05:00
Author
Owner
Copy Link

@szilardx commented on GitHub (May 28, 2025):

According to the signature auth.api.userHasPermission has to accept an undefined role. But if I pass undefined as a role, it throws APIError: Invalid body parameters.

@szilardx commented on GitHub (May 28, 2025): According to the signature auth.api.userHasPermission has to accept an undefined role. But if I pass undefined as a role, it throws APIError: Invalid body parameters.
GiteaMirror commented 2026-03-13 08:07:37 -05:00
Author
Owner
Copy Link

@takeshikriang commented on GitHub (Jun 3, 2025):

I ran into the same issue and have to use userId instead of role

const results = await auth.api.userHasPermission({
  body: {
    userId: 'my_user_id',
    permissions: {
      user: ['create']
    }
  }
});
@takeshikriang commented on GitHub (Jun 3, 2025): I ran into the same issue and have to use `userId` instead of `role` ``` const results = await auth.api.userHasPermission({ body: { userId: 'my_user_id', permissions: { user: ['create'] } } }); ```
GiteaMirror commented 2026-03-13 08:07:37 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Jun 13, 2025):

Can you please update Better Auth to the latest version and see if you run into this issue?

@Kinfe123 commented on GitHub (Jun 13, 2025): Can you please update Better Auth to the latest version and see if you run into this issue?
GiteaMirror commented 2026-03-13 08:07:38 -05:00
Author
Owner
Copy Link

@Kinfe123 commented on GitHub (Jun 13, 2025):

alternatively please check by installing this

npm i https://pkg.pr.new/better-auth/better-auth@3018

i have added additional guard on it. and let me know if it works.

@Kinfe123 commented on GitHub (Jun 13, 2025): alternatively please check by installing this ``` npm i https://pkg.pr.new/better-auth/better-auth@3018 ``` i have added additional guard on it. and let me know if it works.
GiteaMirror commented 2026-03-13 08:07:38 -05:00
Author
Owner
Copy Link

@ping-maxwell commented on GitHub (Jul 1, 2025):

It's been 2-3 weeks now, given no response I'll close this.

@ping-maxwell commented on GitHub (Jul 1, 2025): It's been 2-3 weeks now, given no response I'll close this.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#863
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?