Auth plugin gaps for workspace/org configuration

Abierto
  • ¿Algo no está bien?
#667 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
typescript
Área
api, authentication, backend

Línea de trabajo

Start by tracing the auth plugin routes and configuration for listOrganizations, client errors, invitation verification, and createTeam; the issue does not name source files or tests. The linked PR in the child project provides context for the workspace settings use case. Done means meeting the listed acceptance criteria, including the optional unified workspace endpoint if that scope is chosen.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

enhancement

While building out the org/team workspace settings page in a child project, we ran into several gaps in the auth plugin that either require extra round-trips, force fragile client-side workarounds, or create confusing UX. These are functionalities that the plugin contract doesn't expose (or exposes in a way that is hard to use) for a standard "workspace settings" UX.

Gaps

1. listOrganizations does not include the caller's membership role

The listOrganizations route returns org metadata (id, name, slug, logo, metadata, createdAt) but not the caller's role in each org. To know whether the user is an owner/admin/member of the currently active org in a switcher/settings page, we have to make a separate getActiveMember call.

Requested change: Include the caller's membership record (at minimum role, ideally memberId) in each item returned by listOrganizations.

2. Auth client errors lack machine-readable codes

Better Auth server errors are thrown with well-defined error codes (e.g. EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION), but the client error object the UI receives only reliably contains a human-readable message. This forces string matching like:

error.message.toLowerCase().includes("email verification required")

which is brittle across versions/locales.

Requested change: Expose the server error code (and ideally status) on the error object returned to the client, so callers can branch on error.code === "EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION".

3. No runtime/config toggle for requireEmailVerificationOnInvitation

The auth plugin configures Better Auth's organization plugin with requireEmailVerificationOnInvitation: true. This makes listUserInvitations (and accept/reject invitation actions) fail for SIWN and passkey users, because those auth methods create synthetic emails with emailVerified: false. There is no exposed config to relax this for wallet/passkey-only apps.

Requested change: Make requireEmailVerificationOnInvitation configurable via plugin options, or automatically bypass the requirement for sessions whose email is synthetic/verified-by-wallet.

4. No single "active workspace" endpoint

To render a workspace settings page we currently need:

  • organization.list() for the org list
  • auth.getActiveMember() for the user's role
  • auth.getContext() / teamWorkspaceQueryOptions for teams and active team
  • organization.listUserInvitations() for pending invites

Requested change: Consider a single getWorkspace endpoint that returns the user's organizations, active organization, active member role, teams, active team, and pending invitations in one call.

5. createTeam does not add the creator as a team member

When a user calls auth.createTeam, the team is created but the creator is not added as a member. The context's teams list is built from teamMember rows, so the newly created team does not appear for the creator until they explicitly call addTeamMember with their own userId. The UI currently has to work around this by calling createTeam followed immediately by addTeamMember for the current user.

Requested change: createTeam should automatically add the calling user as a member (owner/admin role) of the new team, or expose a separate createTeamAndJoin convenience route.

Acceptance criteria

  • listOrganizations includes caller role per org.
  • Client error objects expose stable code and status fields.
  • requireEmailVerificationOnInvitation is configurable or bypassed for synthetic SIWN/passkey emails.
  • createTeam automatically adds the creator as a team member (or a convenience route is provided).
  • (Optional) A unified workspace context endpoint reduces the call graph for settings pages.

Context

Lenguaje dominante
TypeScript
Estrellas
5
Forks
3
Merge medio
9 h 20 min
PR fusionados (30 d)
159

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de NEARBuilders/everything-dev

Todos los issues de NEARBuilders/everything-dev

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.