bug: Better Auth account-info rejects useAccountCookie over HTTP (upstream better-auth#10911)

Aperta
  • Qualcosa non va?
#171 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@mustafaskyer ci sta già lavorando.

Dal 1/11/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

bug
Area

Providers and integrations

RELKIT version

@relkit/better-auth 0.8.3 (workspace main), with better-auth 1.7.1

Tracking issue for an upstream Better Auth bug that RELKIT apps hit through the API reference. The defect is in Better Auth, not RELKIT; this issue stays open until the upstream fix ships and we have verified it here.

Upstream
  • Issue: better-auth/better-auth#10911 — accountInfo (GET) rejects useAccountCookie: true
  • Fix: better-auth/better-auth#10918 — open, awaiting review

account-info shares an account-selection schema with POST endpoints and declares useAccountCookie: z.literal(true). A GET query value always arrives as text, so ?useAccountCookie=true sends "true" and can never match. get-session does not have this problem because its booleans use z.coerce.boolean().

Minimal reproduction
  1. In a RELKIT app with Better Auth, sign in with POST /api/auth/sign-in/email.
  2. Open the API reference (relkit inspector → Scalar, or the app's own reference) and send GET /api/auth/account-info?useAccountCookie=true.

The same request against a plain betterAuth() instance with no RELKIT code returns the same error, which confirms the defect is upstream.

Expected behavior

?useAccountCookie=true passes validation and selects the account from its signed OAuth cookie, as the Better Auth docs describe.

Actual behavior and logs
GET /api/auth/account-info?useAccountCookie=true
400 {"code":"VALIDATION_ERROR","message":"[query] Must match one of 2 shapes: (accountId: required, expected string, useAccountCookie: not accepted in this shape) or (useAccountCookie: expected true, received the text \"true\")"}

Plain Better Auth returns [query] Invalid input; the field-level wording above comes from RELKIT's validation detail in packages/better-auth/src/validation-detail.ts.

Environment

Bun 1.3.10, macOS (Darwin 24.6.0, arm64)

To close this issue
  • Better Auth releases a version that includes the fix (better-auth/better-auth#10918 or an alternative).
  • Bump better-auth in the workspace catalog and the CLI build catalog.
  • Re-run the reproduction: GET /api/auth/account-info?useAccountCookie=true passes validation (with no OAuth account cookie it should then fail with an account error, not VALIDATION_ERROR).
  • Update packages/better-auth/tests/validation-detail.test.ts: the test "shows the received value when a query string cannot match a non-string field" uses this upstream bug as its fixture, so it needs another non-string query field.
  • Confirm the API reference still documents the account-info alternatives (packages/better-auth/tests/openapi-query.test.ts).
Lingua principale
TypeScript
Stelle
1
Fork
0
Merge medio
2h 45m
PR unite (30g)
64

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di rel-kit/relkit

Tutte le issue di rel-kit/relkit

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.