Repository navigation
Conversation
Better Auth signs in against auth_account.password (provider 'credential'), not auth_user.password_hash. Five password-write paths only updated the legacy column, causing sign-in failures after registration, invitation acceptance, password reset, admin create-user, and admin edit-user. Security hardening: - seed-admin gated behind ENABLE_SEED_ADMIN + non-production ENVIRONMENT - verifySecurityConfig runs on EVERY request (memoized), not just cold boot - escapeHtml applied to user-controlled template values (XSS prevention) - register/form atomically creates auth_user + auth_account in db.batch() - first-user registration seeds RBAC before role assignment, rolls back on failure E2E test fixes: - database-tools truncate test no longer wipes DB mid-suite - CORS tests use TEST_ORIGIN instead of hardcoded localhost:8787 - settings/plugin/multi-tenant tests restore state in afterEach/afterAll - lexical/json-viewer tests use correct collection name (blog_post) - cache-invalidation uses correct auth endpoint and credentials - block-stable-ids removes nonexistent import - marketing-home skipped (tests marketing site, not CMS) New E2E tests: seed-admin gate, admin-set-password, register-credential. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Applies security fixes from Mark's reviewed PRs (#1097, #1103, #1104, #1105, #1063, #1065, #1066, #1057) directly, resolving auth cascade failures and XSS vectors.
Changes
auth_account.password, notauth_user.password_hash. All 5 password-write paths (register, accept-invitation, reset-password, admin create-user, admin edit-user) now atomically sync both viasyncCredentialPassword()helper +db.batch()/auth/seed-admingated behindENABLE_SEED_ADMIN="true"+ non-productionENVIRONMENTcheckverifySecurityConfigruns on every request (memoized per-isolate), not just cold boot — warm isolates and KV fast-path no longer skip the checkescapeHtmlapplied to user-controlled values in media grid, media details, and content list templatesTesting
Unit Tests
E2E Tests
114-seed-admin-env-gate.spec.ts— seed-admin env gate + sign-in115-admin-set-password.spec.ts— admin-created user can sign in, password change works116-register-credential.spec.ts— registered user can sign in immediatelyChecklist
Generated with Claude Code in Conductor
🤖 Generated with Claude Code