github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-23 07:18:56 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

Admin and Organization plugins Attribute Based Access Control #994

New Issue
Closed
opened 2026-03-13 08:16:14 -05:00 by GiteaMirror · 8 comments
GiteaMirror commented 2026-03-13 08:16:14 -05:00
Owner
Copy Link

Originally created by @iamleniac on GitHub (Apr 7, 2025).

Is this suited for github?

  • Yes, this is suited for github

Is your feature request related to a problem? Please describe.

No response

Describe the solution you'd like

I have a use case where I want to enable ABAC, and I think it can be done in better-auth, but it seems the library focuses too strongly on RBAC.

The way access controls works right now in better-auth with the pattern of resource: [...permissions] would be enough to enable ABAC, but forcing the user to have a role makes it annoying to implement since you'd have to implement many custom roles and still not achieve the granularity you'd like.

I might be completely off, but it seems to me if role becomes somewhat optional, or configurable (e.g. enableAbac: true) and having a permissions field on the user would already achieve ABAC.

Describe alternatives you've considered

I've considered writing a ABAC plugin, but it does not seem like a good idea since the project already has the admin and organization plugins. I would be willing to contribute with the code to achieve this feature on the already existing plugins though.

Additional context

No response

Originally created by @iamleniac on GitHub (Apr 7, 2025). ### Is this suited for github? - [x] Yes, this is suited for github ### Is your feature request related to a problem? Please describe. _No response_ ### Describe the solution you'd like I have a use case where I want to enable ABAC, and I think it can be done in better-auth, but it seems the library focuses too strongly on RBAC. The way access controls works right now in better-auth with the pattern of `resource: [...permissions]` would be enough to enable ABAC, but forcing the user to have a `role` makes it annoying to implement since you'd have to implement many custom roles and still not achieve the granularity you'd like. I might be completely off, but it seems to me if `role` becomes somewhat optional, or configurable (e.g. `enableAbac: true`) and having a `permissions` field on the user would already achieve ABAC. ### Describe alternatives you've considered I've considered writing a ABAC plugin, but it does not seem like a good idea since the project already has the admin and organization plugins. I would be willing to contribute with the code to achieve this feature on the already existing plugins though. ### Additional context _No response_
GiteaMirror added the enhancement label 2026-03-13 08:16:14 -05:00
GiteaMirror commented 2026-03-13 08:16:15 -05:00
Author
Owner
Copy Link

@bismitpanda commented on GitHub (Apr 22, 2025):

I have totally bypassed the better-auth provided RBAC and have used permit.io as my permission checker. Basically every role has every permission according to better-auth. Since I use tRPC, I created a middleware which checks the role/attributes (a field in my user table) and then queries permit.io to see if action is permitted on the resource.

@bismitpanda commented on GitHub (Apr 22, 2025): I have totally bypassed the `better-auth` provided `RBAC` and have used `permit.io` as my permission checker. Basically every role has every permission according to `better-auth`. Since I use `tRPC`, I created a middleware which checks the role/attributes (a field in my user table) and then queries `permit.io` to see if action is permitted on the resource.
GiteaMirror commented 2026-03-13 08:16:16 -05:00
Author
Owner
Copy Link

@reslear commented on GitHub (Jul 7, 2025):

@bismitpanda same, maybe in the future we'll be back

@reslear commented on GitHub (Jul 7, 2025): @bismitpanda same, maybe in the future we'll be back
GiteaMirror commented 2026-03-13 08:16:16 -05:00
Author
Owner
Copy Link

@coopbri commented on GitHub (Aug 11, 2025):

Similar use case, but also looking for relationship-based access control (ReBAC). There is this community plugin that might work for you! https://github.com/cnbrown04/better-auth-abac

I asked about ReBAC on that plugin here: https://github.com/cnbrown04/better-auth-abac/issues/10

Huge discussion about extending BA RBAC in the Discord server: https://discord.com/channels/1288403910284935179/1296953610734665770/1296953610734665770

EDIT: somewhat related, there is also this PR to expand official organization plugin here: https://github.com/better-auth/better-auth/pull/3023

@coopbri commented on GitHub (Aug 11, 2025): Similar use case, but also looking for relationship-based access control (ReBAC). There is this community plugin that might work for you! https://github.com/cnbrown04/better-auth-abac I asked about ReBAC on that plugin here: https://github.com/cnbrown04/better-auth-abac/issues/10 Huge discussion about extending BA RBAC in the Discord server: https://discord.com/channels/1288403910284935179/1296953610734665770/1296953610734665770 EDIT: somewhat related, there is also this PR to expand official organization plugin here: https://github.com/better-auth/better-auth/pull/3023
GiteaMirror commented 2026-03-13 08:16:17 -05:00
Author
Owner
Copy Link

@Onassis-dev commented on GitHub (Aug 12, 2025):

I have the same problem, I'll find a workaround and post any updates.

@Onassis-dev commented on GitHub (Aug 12, 2025): I have the same problem, I'll find a workaround and post any updates.
GiteaMirror commented 2026-03-13 08:16:18 -05:00
Author
Owner
Copy Link

@maelp commented on GitHub (Aug 29, 2025):

I'd be interested in fine-grained permissions! Like saying "user has 'delete' permission on resource 'post' if post.author_id === user.id"

@maelp commented on GitHub (Aug 29, 2025): I'd be interested in fine-grained permissions! Like saying "user has 'delete' permission on resource 'post' if post.author_id === user.id"
GiteaMirror commented 2026-03-13 08:16:19 -05:00
Author
Owner
Copy Link

@Xentox-Phil commented on GitHub (Nov 5, 2025):

I'd be interested in fine-grained permissions! Like saying "user has 'delete' permission on resource 'post' if post.author_id === user.id"

https://github.com/fatihky/pundit-ts

What about this library?
What you are searching for is a Attribute-Based Access Control (ABAC)!

Here an example adjusted to your scenario:

class Policy {
  authorize(ctx, object, action) {
    // non logged-in users cannot perform any action...
    if (ctx.actor === null) {
      throw new UnauthorizedError();
    }

    const role = ctx.actor.role;
    const post = ctx.post
    const isAdmin = role === "admin";
    const isEditor = role === "editor";

    switch (action) {
      case "delete": // only admins can delete the record
        return isAdmin;

      // update permissions
      case "update:content":
        return (post.author_id === ctx.actor.id) || isAdmin // here your requested check
      case "update:title":
        return isAdmin;

      case "view:content":
      case "view:title":
        return true; // everyone can view title and content

      default:
        return false;
    }
  }
}
@Xentox-Phil commented on GitHub (Nov 5, 2025): > I'd be interested in fine-grained permissions! Like saying "user has 'delete' permission on resource 'post' if post.author_id === user.id" https://github.com/fatihky/pundit-ts What about this library? What you are searching for is a Attribute-Based Access Control (ABAC)! Here an example adjusted to your scenario: ```ts class Policy { authorize(ctx, object, action) { // non logged-in users cannot perform any action... if (ctx.actor === null) { throw new UnauthorizedError(); } const role = ctx.actor.role; const post = ctx.post const isAdmin = role === "admin"; const isEditor = role === "editor"; switch (action) { case "delete": // only admins can delete the record return isAdmin; // update permissions case "update:content": return (post.author_id === ctx.actor.id) || isAdmin // here your requested check case "update:title": return isAdmin; case "view:content": case "view:title": return true; // everyone can view title and content default: return false; } } } ```
GiteaMirror commented 2026-03-13 08:16:19 -05:00
Author
Owner
Copy Link

@maelp commented on GitHub (Nov 5, 2025):

Indeed! There is also https://permix.letstri.dev/

@maelp commented on GitHub (Nov 5, 2025): Indeed! There is also https://permix.letstri.dev/
GiteaMirror commented 2026-03-13 08:16:19 -05:00
Author
Owner
Copy Link

@dosubot[bot] commented on GitHub (Feb 4, 2026):

Hi, @iamleniac. I'm Dosu, and I'm helping the better-auth team manage their backlog and am marking this issue as stale.

Issue Summary:

  • You requested adding Attribute Based Access Control (ABAC) support to better-auth for more granular permissions beyond RBAC.
  • Several community members shared workarounds using external permission checkers like permit.io and community plugins.
  • There is ongoing interest and discussion around integrating fine-grained permission libraries such as pundit-ts and permix.
  • No official ABAC support or resolution has been implemented yet.

Next Steps:

  • Please let me know if this issue is still relevant to the latest version of better-auth by commenting here to keep the discussion open.
  • If I don’t hear back within 7 days, this issue will be automatically closed.

Thanks for your understanding and contribution!

@dosubot[bot] commented on GitHub (Feb 4, 2026): Hi, @iamleniac. I'm [Dosu](https://dosu.dev), and I'm helping the better-auth team manage their backlog and am marking this issue as stale. **Issue Summary:** - You requested adding Attribute Based Access Control (ABAC) support to better-auth for more granular permissions beyond RBAC. - Several community members shared workarounds using external permission checkers like permit.io and community plugins. - There is ongoing interest and discussion around integrating fine-grained permission libraries such as pundit-ts and permix. - No official ABAC support or resolution has been implemented yet. **Next Steps:** - Please let me know if this issue is still relevant to the latest version of better-auth by commenting here to keep the discussion open. - If I don’t hear back within 7 days, this issue will be automatically closed. Thanks for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#994
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?