Repository navigation
Auth schema follows Better Auth; migrations reset to one 0001 - #40
Merged
Merged
Conversation
user/session/account/verification/apikey/oauthClient/oauthConsent/ oauthAccessToken/oauthRefreshToken/oauthClientAssertion replace account/web_session/email_code/api_key/oauth_client/oauth_grant/ oauth_token; oauth_request, beta_allowlist and waitlist stay Outer-shaped with userId. INTEGER-ms dates and sha256-only secret columns are documented departures. All code paths and fixtures re-pointed; plan/quota/metrics/prune/console behavior unchanged.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 32 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…iry/revoked checks, consent FK, strict resource 1. exchange_code/exchange_refresh require client_id (invalid_client when absent, invalid_grant on mismatch) before any state change. 2. Refresh rotation (consent-live recheck, claim, mint) and reuse revocation run in single transactions. 3. Banned (banExpires-aware) and missing users fail both grant types. 4/5. resolve_bearer enforces apikey.expiresAt and token revoked flag. 6. oauthAccessToken/oauthRefreshToken.referenceId FK to oauthConsent with cascade. 7. Token resource must equal the authorize request's (no downgrade to server default). Tests: 5 new finding-pinning tests; existing token tests send client_id.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner: auth tables follow Better Auth's database structure (https://better-auth.com/docs/concepts/database), and all migrations merge into one fresh
0001_init.sql; production starts from an empty database when this ships (owner-approved, single user).Mapping (Better Auth core + api-key + oauth-provider/MCP + admin):
accountuser(core + adminrole/banned/banReason/banExpires+ Outer extrasplan,planStatus, Stripe ids,graceUntil, terms,lastActiveAt)email_codeverification(identifier = 'email-verification:<email>',value= code hash, +attempts)web_sessionsession(token= sha256 of the cookie)api_keyapikey(key= sha256,referenceId→ user,enabled,lastRequest, + client name/version)oauth_clientoauthClient(+kind,host,verified,fetchedAt,lastTokenAt)oauth_grantoauthConsent(+ client name/version,lastUsedAt,revokedAt)oauth_tokenoauthAccessToken+oauthRefreshToken(rotatedAtkeeps refresh-reuse revocation)oauth_requestaccount,oauthClientAssertioncreated in Better Auth's shape, unusedagent_action,app_collaborator,usage_*now referenceuser. Departures from Better Auth, stated in the migration header: INTEGER-ms dates, and only hashes are stored for session tokens, verification codes, API keys and OAuth tokens (Better Auth keeps raw session tokens).Sources: the database doc,
@better-auth/coretable definitions,@better-auth/api-key,@better-auth/oauth-providerschema, the admin plugin schema, and Noite's live Better Auth SQLite schema.Behavior is unchanged: every existing auth, OAuth (CIMD/DCR, PKCE, refresh rotation and reuse revocation), MCP and console test passes with only table/column names adapted in fixtures; two bind-order bugs caught by those tests during the port were fixed. New test: a fresh DB applies
0001andPRAGMA foreign_key_checkis empty. 438 pass.Ship plan: after tonight's M1 live checks (they use the current API key), run the reset runbook — delete apps, stop, remove
outer.sqlite*and the R2 state snapshot, release, re-sync the template — then the owner reconnects ChatGPT, Claude, Gemini, Perplexity and the console.