fix(auth): expose roles[] on session user so admin promotion preserves business roles#1729
Merged
Merged
Conversation
…s business roles The customSession plugin replaces user.role with the literal 'admin' when the user is a platform admin or active-org admin, which destroyed any stored business roles (e.g. 'manager' in a comma-separated 'admin,manager' value). Consumers matching pending approvers by role:<name> (Console approvals inbox) therefore never saw an admin's role-based todos. The session payload now always carries user.roles: string[] — the stored role string split on commas, with 'admin' appended (deduplicated) on promotion. user.role semantics are unchanged: existing strict user.role === 'admin' checks keep working. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The better-auth
customSessionplugin inplugin-authreturns{ user: { ...user, role: 'admin' }, session }when the user is a platform admin or active-org admin. This replaces the stored role string — which may be comma-separated multi-role, e.g.'admin,manager'— with the literal'admin'.Consequence: an admin's business roles (e.g.
manager) never reach the frontend through the session, so the Console approvals inbox (objectuiApprovalsInboxPage), which matchespending_approversbyrole:<name>literals, never shows admins their role-based todos.Fix (additive —
user.rolesemantics unchanged)The customSession callback now always returns
user.roles: string[]:user.rolesplit on commas, trimmed, empty values dropped (no role →[])'admin'is appended, deduplicateduser.rolebehavior is exactly as before (still replaced by'admin'on promotion, kept otherwise) — the codebase has many strictuser.role === 'admin'checksobjectui consumers already prefer
user.roleswhen present (useIsWorkspaceAdmin,AuthGuard,buildApproverIdentities), so no objectui change is needed.Tests
New
customSession – derived role and roles arraysuite inauth-manager.test.tscovering: no stored role →roles=[]; non-admin'manager'→roles=['manager']withroleuntouched; platform admin storing'manager'→role='admin',roles=['manager','admin']; stored'admin,manager'→ no duplicate append; user without id passes through untouched.pnpm vitest run(plugin-auth): 114 passedpnpm --filter @objectstack/plugin-auth build: ESM/CJS/DTS pass🤖 Generated with Claude Code