mirror of
https://github.com/better-auth/better-auth.git
synced 2026-10-20 20:26:55 -05:00
Gustavo Valverde
36a6c2ea03
The approval guard filtered userId on null, which serial ids turn into 0, so every approval returned 409. Pending clients come only from anonymous registration and never have a userId, so the guard now checks referenceId alone. Pending clients also store referenceId as null, because Prisma on MongoDB does not match unset fields with a null filter. A pending private_key_jwt client can rotate its inline keys again: the pending check in client assertion verification only guarded key rotation, and token endpoints already refuse pending clients.