Gustavo Valverde
ec6284f30d
Add approvePendingClient. With it defined, a client created by open dynamic registration or discovered through CIMD stays pending until a user consents. A pending client cannot authenticate at the token, introspection, revocation, or device authorization endpoints, and the authorization endpoint always sends its users to consent. A pending client must register authorization_code, since consent is the only way to approve it. Registrations by a signed-in user or with an initial access token are not pending. When the user accepts, the callback names the owner (clientReference). The update is conditional on the client still being pending and ownerless and runs in the same transaction as the consent, so concurrent approvals produce one winner and an owned client is never reassigned. Returning false redirects to the client with access_denied, like a denied consent. Approval grants no machine access. Open registration may request client_credentials, but the scope limit is still assigned only through adminUpdateOAuthClient, which clientPrivileges gates. A CIMD refresh no longer writes the scope limit, disabled, skipConsent, or enableEndSession from its pre-fetch snapshot, so a change committed during the fetch is kept. Without the option, behavior is unchanged. Adds a nullable pending column to oauthClient.
Better Auth
Better Auth is a framework-agnostic authentication (and authorization) framework for TypeScript. It provides a comprehensive set of features out of the box and includes a plugin ecosystem that simplifies adding advanced functionalities with minimal code in a short amount of time. Whether you need 2FA, multi-tenant support, or other complex features, it lets you focus on building your actual application instead of reinventing the wheel.
Why Better Auth
Authentication in the TypeScript ecosystem is a half-solved problem. Other open-source libraries often require a lot of additional code for anything beyond basic authentication. Rather than just pushing third-party services as the solution, I believe we can do better as a community—hence, Better Auth.
Contribution
Better Auth is a free and open source project licensed under the MIT License. You are free to do whatever you want with it.
You could help continuing its development by:
Security
If you discover a security vulnerability within Better Auth, please report it via GitHub Security Advisories.
All reports will be promptly addressed, and you'll be credited accordingly.