github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 23:52:05 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[GH-ISSUE #4193] Failure to create an account/session after user creation should rollback #9858

New Issue
Closed
opened 2026-04-13 05:38:14 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-04-13 05:38:14 -05:00
Owner
Copy Link

Originally created by @austinm911 on GitHub (Aug 24, 2025).
Original GitHub issue: https://github.com/better-auth/better-auth/issues/4193

Is this suited for github?

  • Yes, this is suited for github

To Reproduce

  1. Setup your schema and auth instance like below.
  2. Create a user await authClient.signUp.email
// all tables plural (sessions, accounts)
export const users = pgTable('users', {
	id: text().primaryKey(),
	name: text().notNull(),
	email: text().notNull().unique(),
	emailVerified: boolean('email_verified').notNull(),
	image: text(),
	createdAt: timestamp('created_at', { withTimezone: true }).notNull(),
	updatedAt: timestamp('updated_at', { withTimezone: true }),
})

export const auth = betterAuth({
	database: drizzleAdapter(db, {
		provider: 'pg',
		schema,
		debugLogs: true,
	}),
	user: {
		modelName: 'users',
	},
	account: {
        // if you exclude this, user will create but account creation will fail
		// modelName: 'accounts', 
	},
	verification: {
		modelName: 'verifications',
	},
    // also missing session object
})

Current vs. Expected behavior

User creation will succeed but not account creation. This happens too if a session is attempted.

It would be expected that these operations work within a database transaction, so if an error occurs the user creation rolls back.

Currently, the setup described would allow a user without an account or session to be created.

What version of Better Auth are you using?

1.3.7

System info

System:
    OS: macOS 15.6
    CPU: (10) arm64 Apple M1 Pro
    Memory: 196.30 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Browsers:
    Brave Browser: 139.1.81.136
    Chrome: 139.0.7258.139
    Safari: 18.6

Which area(s) are affected? (Select all that apply)

Backend

Auth config (if applicable)

import { betterAuth } from "better-auth"
export const auth = betterAuth({
  emailAndPassword: {  
    enabled: true
  },
});

Additional context

No response

Originally created by @austinm911 on GitHub (Aug 24, 2025). Original GitHub issue: https://github.com/better-auth/better-auth/issues/4193 ### Is this suited for github? - [x] Yes, this is suited for github ### To Reproduce 1. Setup your schema and auth instance like below. 2. Create a user `await authClient.signUp.email` ```ts // all tables plural (sessions, accounts) export const users = pgTable('users', { id: text().primaryKey(), name: text().notNull(), email: text().notNull().unique(), emailVerified: boolean('email_verified').notNull(), image: text(), createdAt: timestamp('created_at', { withTimezone: true }).notNull(), updatedAt: timestamp('updated_at', { withTimezone: true }), }) export const auth = betterAuth({ database: drizzleAdapter(db, { provider: 'pg', schema, debugLogs: true, }), user: { modelName: 'users', }, account: { // if you exclude this, user will create but account creation will fail // modelName: 'accounts', }, verification: { modelName: 'verifications', }, // also missing session object }) ``` ### Current vs. Expected behavior User creation will succeed but not account creation. This happens too if a session is attempted. It would be expected that these operations work within a database transaction, so if an error occurs the user creation rolls back. Currently, the setup described would allow a user without an account or session to be created. ### What version of Better Auth are you using? 1.3.7 ### System info ```bash System: OS: macOS 15.6 CPU: (10) arm64 Apple M1 Pro Memory: 196.30 MB / 16.00 GB Shell: 5.9 - /bin/zsh Browsers: Brave Browser: 139.1.81.136 Chrome: 139.0.7258.139 Safari: 18.6 ``` ### Which area(s) are affected? (Select all that apply) Backend ### Auth config (if applicable) ```typescript import { betterAuth } from "better-auth" export const auth = betterAuth({ emailAndPassword: { enabled: true }, }); ``` ### Additional context _No response_
GiteaMirror added the lockedbug labels 2026-04-13 05:38:14 -05:00
GiteaMirror commented 2026-04-13 05:38:16 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Aug 24, 2025):

Better Auth v1.3.7 does not support transactional integrity for user, account, and session creation—these steps are executed independently, so if account or session creation fails after the user is created, the user record remains in the database. There is no built-in rollback or atomic transaction wrapping these operations, which matches your experience and is a known limitation as discussed here.

This behavior is not currently configurable, and there are no recommended workarounds for enforcing transactional integrity in the current version. Some users have tried after-hooks to clean up partial records, but this is brittle and does not guarantee atomicity see discussion. If atomic multi-step creation is critical for your use case, you would need to implement custom transaction logic outside of Better Auth for now.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other  Chat with Dosu Join Discord Share on X

<!-- gh-comment-id:3217883822 --> @dosubot[bot] commented on GitHub (Aug 24, 2025): <!-- Answer --> Better Auth v1.3.7 does not support transactional integrity for user, account, and session creation—these steps are executed independently, so if account or session creation fails after the user is created, the user record remains in the database. There is no built-in rollback or atomic transaction wrapping these operations, which matches your experience and is a known limitation [as discussed here](https://github.com/better-auth/better-auth/issues/4193). This behavior is not currently configurable, and there are no recommended workarounds for enforcing transactional integrity in the current version. Some users have tried after-hooks to clean up partial records, but this is brittle and does not guarantee atomicity [see discussion](https://github.com/better-auth/better-auth/issues/2742). If atomic multi-step creation is critical for your use case, you would need to implement custom transaction logic outside of Better Auth for now. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/ee791b67-6cd5-4b93-8499-520275042f01?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/ee791b67-6cd5-4b93-8499-520275042f01?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/ee791b67-6cd5-4b93-8499-520275042f01?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/ee791b67-6cd5-4b93-8499-520275042f01?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/ee791b67-6cd5-4b93-8499-520275042f01?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/ee791b67-6cd5-4b93-8499-520275042f01?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/ee791b67-6cd5-4b93-8499-520275042f01?feedback_type=other)</sup>&nbsp;&nbsp;[![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/cdda13d9-dd27-4d31-b09a-5d8bec92de21/ask?utm_source=github)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/better-auth/better-auth/issues/4193)
GiteaMirror commented 2026-04-13 05:38:17 -05:00
Author
Owner
Copy Link

@iamsg97 commented on GitHub (Sep 1, 2025):

If an apt PR is linked, then is why is this BUG still open? Does it need work?

cc: @ShobhitPatra @Kinfe123

<!-- gh-comment-id:3240741406 --> @iamsg97 commented on GitHub (Sep 1, 2025): If an apt PR is linked, then is why is this BUG still open? Does it need work? cc: @ShobhitPatra @Kinfe123
GiteaMirror commented 2026-04-13 05:38:17 -05:00
Author
Owner
Copy Link

@himself65 commented on GitHub (Sep 16, 2025):

If an apt PR is linked, then is why is this BUG still open? Does it need work?

cc: @ShobhitPatra @Kinfe123

We are working some infra update

<!-- gh-comment-id:3300540448 --> @himself65 commented on GitHub (Sep 16, 2025): > If an apt PR is linked, then is why is this BUG still open? Does it need work? > > cc: [@ShobhitPatra](https://github.com/ShobhitPatra) [@Kinfe123](https://github.com/Kinfe123) We are working some infra update
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label bug locked
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#9858
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?