Skip to content

docs(plugin-auth): re-measure the three version-stamped vendor attestations outside #10073's two-string scope#11446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-sam merged 3 commits into from
Aug 23, 2026
+18 −10
Merged

docs(plugin-auth): re-measure the three version-stamped vendor attestations outside #10073's two-string scope #11446

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0432394
docs(plugin-auth): re-measure the three version-stamped attestations …
claude Aug 23, 2026
d8fae0f
Merge remote-tracking branch 'origin/main' into claude/issue-10188-pl…
claude Aug 23, 2026
a3f1ad7
docs(plugin-auth): make the OAuth-client reverse control a reproducib…
claude Aug 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions packages/plugins/plugin-auth/src/auth-manager.test.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1942,8 +1942,9 @@ describe('AuthManager', () => {
// Rethrowing that envelope as a plain `Error` made better-call answer
// **500 with a null body**: its router maps only `APIError`
// (`isAPIError = err instanceof APIError || err?.name === 'APIError'`,
// better-call@1.3.7 `dist/utils.mjs:57`, consumed at `dist/router.mjs:93`),
// and everything else takes the `console.error` + 500 branch. Meanwhile the
// better-call@1.4.0 `dist/utils.mjs:55-56`, consumed at `dist/router.mjs:92`;
// re-measured 2026-08-23 against the installed copy), and everything
// else takes the `console.error` + 500 branch (`:93-97`). Meanwhile the
// per-number wall on the SAME endpoint (`assertPhoneOtpSendAllowed`, in the
// admission hook) throws a real `APIError('TOO_MANY_REQUESTS')` and answers
// 429 — so one endpoint spoke with two voices, which is the reverse of what
Expand Down
5 changes: 3 additions & 2 deletions packages/plugins/plugin-auth/src/auth-manager.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -918,8 +918,9 @@ export function normalizeAuthEmailLocale(raw: string | undefined): string | unde
*
* better-call (better-auth's router) maps ONLY `APIError` to a real HTTP status:
* `isAPIError(err) = err instanceof APIError || err?.name === 'APIError'`
* (better-call@1.3.7 `dist/utils.mjs:57`), consumed at `dist/router.mjs:93`,
* where everything else takes the `console.error` + `500 / null body` branch.
* (better-call@1.4.0 `dist/utils.mjs:55-56`), consumed at `dist/router.mjs:92`,
* where everything else takes the `console.error` + `500 / null body` branch
* (`:93-97`; re-measured 2026-08-23 against the installed copy).
* A plain `Error` therefore buried `TOO_MANY_REQUESTS` in a server log while the
* per-number wall on the same endpoint ({@link AuthManager.assertPhoneOtpSendAllowed})
* answered 429 — one endpoint, two voices.
Expand Down
18 changes: 12 additions & 6 deletions packages/plugins/plugin-auth/src/auth-plugin.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1754,12 +1754,18 @@ export class AuthPlugin implements Plugin {
// OAuth admin: toggle the `disabled` flag on a registered OAuth client.
//
// Why this lives here (and not as a plain data-layer UPDATE on
// sys_oauth_application): better-auth 1.6.11's stock admin update
// endpoint (`/admin/oauth2/update-client`) does NOT accept `disabled`
// in its Zod body schema, so the field gets silently stripped before
// it reaches `updateClientEndpoint`. The column exists, the runtime
// honours it everywhere (introspect, token, authorize, public-client
// lookup), but no client-facing API can flip it.
// sys_oauth_application): the stock admin update endpoint
// (`/admin/oauth2/update-client`) does NOT accept `disabled` in its
// Zod body schema, so the field gets silently stripped before it
// reaches `updateClientEndpoint`. Re-measured 2026-08-23 against the
// installed @better-auth/oauth-provider 1.7.1 (the package that
// carries the endpoint at 1.7.x): `adminUpdateOAuthClient`
// (`dist/authorize-Crqw4_bR.mjs:2860`) declares its body schema at
// `:2862-2889`, and `disabled` occurs zero times in that block —
// while matching 35 other lines of the same file (`grep -c`), so the
// search reaches the text. The column exists, the runtime honours it
// everywhere (introspect, token, authorize, public-client lookup),
// but no client-facing API can flip it.
//
// We close the gap by writing through better-auth's own adapter under
// the `/api/v1/auth/*` namespace so all OAuth-application mutations
Expand Down
Loading