Gustavo Valverde
36a6c2ea03
The approval guard filtered userId on null, which serial ids turn into 0, so every approval returned 409. Pending clients come only from anonymous registration and never have a userId, so the guard now checks referenceId alone. Pending clients also store referenceId as null, because Prisma on MongoDB does not match unset fields with a null filter. A pending private_key_jwt client can rotate its inline keys again: the pending check in client assertion verification only guarded key rotation, and token endpoints already refuse pending clients.
Better Auth
Better Auth is a framework-agnostic authentication (and authorization) framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a short amount of time. Whether you need 2FA, multi-tenant support, or other complex features, it lets you focus on building your actual application instead of reinventing the wheel.
Why Better Auth
Authentication in the TypeScript ecosystem is a half-solved problem. Other open-source libraries often require a lot of additional code for anything beyond basic authentication. Rather than just pushing third-party services as the solution, I believe we can do better as a community—hence, Better Auth.
Contribution
Better Auth is a free and open source project licensed under the MIT License. You are free to do whatever you want with it.
You could help continuing its development by:
Security
If you discover a security vulnerability within Better Auth, please report it via GitHub Security Advisories.
All reports will be promptly addressed, and you'll be credited accordingly.