Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

`consumeOne` method not implemented — password reset broken with `better-auth >=1.7.0`

Open
#2,820 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
60/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
postgresql, typescript

Research direction

Start in the @zenstackhq/better-auth adapter package and read the existing adapter methods (findOne, delete/consume on the verification table) to see the conventions for token records. Then check the better-auth 1.7 adapter contract for consumeOne's exact signature and return shape before implementing an atomic find-and-delete. Done means a password reset completes on better-auth 1.7.x with an unmodified caller, and the peerDependencies range in the adapter package reflects the supported version. A test exercising sendResetPassword end to end is the way to confirm it.

Written by the indexing model from the issue text.

Description

Description

The zenstackAdapter does not implement the consumeOne method, which became required in [email protected]. This causes a BetterAuthError when users attempt to reset their password.

Error

BetterAuthError: Adapter "zenstack" must implement consumeOne for atomic single-use credential consumption.
    at factory.mjs:699:68

Steps to Reproduce

  1. Set up a project with better-auth@^1.6.26 (resolves to 1.7.x) and @zenstackhq/[email protected]
  2. Configure email/password with sendResetPassword
  3. Request a password reset email
  4. Click the reset link and submit the new password
  5. The error above is thrown

Expected Behavior

Password reset completes successfully. The consumeOne method should atomically find and delete the single-use token from the verification table.

Environment

  • @zenstackhq/better-auth: 3.9.2
  • better-auth: 1.7.1
  • Provider: PostgreSQL

Notes

  • [email protected] introduced consumeOne as a required adapter method for atomic single-use credential consumption (used for password reset tokens and potentially email verification tokens).
  • The peerDependencies allow better-auth: "^1.3.0", but the adapter does not work with 1.7.x.
  • As a workaround, I've pinned better-auth to ~1.6.26 to avoid the breaking change.
  • This likely affects all versions of @zenstackhq/better-auth.

Workaround

Pin better-auth to ~1.6.26 in your package.json:

"better-auth": "~1.6.26"
Dominant language
TypeScript
Stars
2.9k
Forks
157
Avg merge
11h 42m
Merged PRs (30d)
20

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from zenstackhq/zenstack

All issues in zenstackhq/zenstack

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.