github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-07-28 06:47:20 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity
Files
auth@1.7.0-beta.4
better-auth/packages/scim/CHANGELOG.md
T

16 KiB
Raw Permalink Blame History

@better-auth/scim

1.7.0-beta.4

Minor Changes

  • #9840 a8ea86e Thanks @gustavovalverde! - Personal (non-organization) SCIM connections now always belong to the user who created them. Owner binding used to be opt-in through the providerOwnership option, which defaulted to off. With it off, a personal connection was stored without an owner, and the management endpoints denied access only when a stored owner differed from the caller. An unowned connection passed that check for any signed-in user, who could read it, list it, regenerate its token, or delete it. Regenerating the token rotated the secret and invalidated the original.

    generateSCIMToken now records the creator's userId on every personal connection. The generate-token, list-provider-connections, get-provider-connection, and delete-provider-connection endpoints grant access only to that owner. Organization-scoped connections keep their existing behavior and continue to use organization membership and the configured requiredRole checks.

    This release is breaking. It removes the providerOwnership option, and owner binding can no longer be disabled. The scimProvider.userId column is now a permanent part of the schema, so run a migration after upgrading with npx auth migrate or npx auth generate.

    Connections created before this release carry no owner. Access now fails closed, so those connections are no longer reachable through the management endpoints, including token regeneration. Reclaim them at the database level: delete scimProvider rows that have neither organizationId nor userId, or set userId to the intended owner, then regenerate tokens as needed. Organization-scoped connections are not affected.

Patch Changes

1.7.0-beta.3

Patch Changes

  • Updated dependencies [4e8e4c7, 523f95c, 729c00d]:
    • better-auth@1.7.0-beta.3
    • @better-auth/core@1.7.0-beta.3

1.7.0-beta.2

Patch Changes

1.7.0-beta.1

Patch Changes

1.7.0-beta.0

Patch Changes

1.6.10

Patch Changes

1.6.9

Patch Changes

  • Updated dependencies [815ecf6]:
    • @better-auth/core@1.6.9
    • better-auth@1.6.9

1.6.8

Patch Changes

  • Updated dependencies [856ab24, 9aa8e63]:
    • better-auth@1.6.8
    • @better-auth/core@1.6.8

1.6.7

Patch Changes

1.6.6

Patch Changes

1.6.5

Patch Changes

  • Updated dependencies [938dd80, 0538627]:
    • better-auth@1.6.5
    • @better-auth/core@1.6.5

1.6.4

Patch Changes

1.6.3

Patch Changes

1.6.2

Patch Changes

1.6.1

Patch Changes

1.6.0

Minor Changes

Patch Changes

1.6.0-beta.0

Minor Changes

  • 28b1291 Thanks @gustavovalverde! - Add optional version field to the plugin interface and expose version from all built-in plugins

Patch Changes

Reference in New Issue View Git Blame Copy Permalink