chore(deps): upgrade better-auth to 1.7.12 by waleedlatif1 · Pull Request #9465 · simstudioai/sim

waleedlatif1 · 2026-10-30T04:01:11Z

Summary

Moves better-auth, @better-auth/oauth-provider, @better-auth/sso, @better-auth/stripe (and packages/auth) from 1.6.27 to 1.7.12. 1.7.7+ fixes the magic-link, OAuth-proxy, device-authorization and DB rate-limit advisories (not reachable today, but 1.6 gets no fixes). Each 1.7 behavior change Sim depends on is adapted, following the 1.7 upgrade guide.

Dependencies

@better-auth/core calls z.validate (zod 4.5+); the root override keeps zod at 4.3.6, so every sign-in would throw. Version-pinned patch restores 1.6's safeParse form (documented in patches/README.md)
Dropped the global @xmldom/xmldom 0.8.15 override: sso 1.7 needs 0.9.12 (onError), while samlify/xml-crypto/mammoth/officeparser/plist keep 0.8.15 (0.9 throws without a MIME type)
Removed the obsolete oauth-provider 1.6.27 resource patch

Integration connectors (generic OAuth lost its /oauth2/* endpoints)

Registered /api/auth/oauth2/callback/:id URIs are forwarded to core /callback/:id — no provider re-registration
Client links via linkSocial; custom getToken keeps the registered redirect URI; Google connectors use explicit endpoints instead of discovery; scope rewrites moved into the token exchange; reserved authorize params (scope, nonce) passed as options; pkce: false kept explicit where 1.6 had it off
Connector callbacks only complete an authenticated link and never sign up/in a user (core doesn't bind state to a provider, so a replayed sign-in state could otherwise sign in whoever owns the email a connector reports)
Account hooks identify connector callbacks by the account's provider — hook contexts carry the route pattern, so the old path check would have skipped credential creation

MCP OAuth provider

Dynamic resources stay out of 1.7's static resource model via a signed sim_resource param
Public clients recognized by token_endpoint_auth_method: none (1.7 dropped public); registration infers app type so loopback/cursor:// callbacks still register; requested scopes are kept; a dpop_jkt is dropped (bearer tokens only, as in 1.6); metadata advertises only what Sim honors; tokens revoked at sign-out are rejected
Confidential clients keep their Basic credentials on the way to Better Auth: 1.7 refuses a client_secret_basic client whose credentials arrive in the body
Migration 0447: expand-only columns/tables, altered in token issuance's lock order, so 1.6 and 1.7 pods share the schema during rollout; runtime schema validation off in the app and the realtime verifier (migrations own the schema)

Enterprise SSO

Legacy SAML ACS URL forwarded to /sso/saml2/sp/acs/:id (POST and GET), so IdPs need no change; new providers advertise the new URL
IdP-initiated SAML (app-portal launches) stays allowed; 1.7 turns it off by default
Registration matches 1.7's strict schemas (no mapping.id; idpMetadata as metadata or entityID) and checks 1.7's sign-in policy on save
Migration 0448 (data, idempotent): writes entityID for cert-only providers, and clears wantAssertionsSigned where SP metadata never asked for signed assertions — keeping 1.6's accept-any-IdP-signature policy so IdPs that sign only the Response keep working; and drops an audience equal to the IdP's own entity ID (the registration script's old default), since 1.7 checks audience exclusively where 1.6 also accepted the SP entity ID
POST sign-in/email-otp refused: 1.7 deletes every linked account of an unverified user there

Behavior changes to expect

In-flight OAuth/SSO/MCP authorizations that span the 1.6→1.7 cutover fail once (state key format changed); retry works
SSO account ids now always come from OIDC sub / SAML NameID; providers that mapped another id claim re-link by email on their verified domain (new account row, same user)
OIDC SSO ID tokens are now always verified, so the stored issuer must match iss exactly
Browser sign-out revokes session-bound MCP access tokens; refresh tokens (offline_access) survive

Type of Change

Dependency update / security

Testing

Unit/route tests for every touched area: ~3,000 tests across auth, SSO, OAuth, credentials, credential groups, contracts
Token route integration covers code exchange + refresh for client_secret_basic and client_secret_post clients (the Basic case fails on the previous code)
17 auth-related integration files on disposable Postgres with all migrations (189 tests): token route, provider lifecycle, token family, lifecycle audit, SSO settings/admission/concurrency/primary provider, credential groups, reconnect conflict, credential revocation, shopify. The reconnect test caught the hook-path issue above
Migration 0448 run twice on fixture rows (cert-only, XML, already-strict, legacy string, bad JSON, non-object, OIDC, audience = IdP issuer / entity ID / SP / custom): correct and idempotent
drizzle-kit generate clean, check:migrations, biome; full type-check and audits run in CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-30T04:01:14Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 30, 2026 6:52am UTC

greptile-apps · 2026-10-30T04:07:03Z

Confidence Score: 5/5

[Critical impact] No new blocking issue was established; the PR appears safe to merge with the acknowledged SAML rollout risk.

Summary

Upgrades Better Auth and its plugins to 1.7.12, with changes for connector linking, MCP OAuth, and enterprise SSO.

Connector sign-ins keep their registered callbacks and link to the signed-in account.
MCP OAuth carries the requested resource into tokens and respects client settings.
Enterprise SSO keeps its saved providers working with Better Auth 1.7.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Client[Client requests resource] --> Check[Authorize route checks resource]
  Check --> Signed[Signed sim_resource through login and consent]
  Signed --> Code[Stored authorization code]
  Code --> Match[Token route checks requested resource matches]
  Match --> Tokens[Store resource-bound tokens]

_{Reviews (4) · Last reviewed commit: "fix(auth): keep confidential OAuth clien..." · Reviewed by Greptile}

cubic-dev-ai

Review completed against the latest diff

_{This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-30T04:17:40Z

@greptile

waleedlatif1 · 2026-10-30T04:17:42Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T04:17:48Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 77 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-30T04:32:09Z

@greptile

waleedlatif1 · 2026-10-30T04:32:10Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T04:32:15Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 77 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

Moves better-auth, @better-auth/oauth-provider, @better-auth/sso and @better-auth/stripe (and packages/auth) from 1.6.27 to 1.7.12, which carries the 1.7.7 fixes for the magic-link, OAuth proxy, device-authorization and rate-limit advisories. Each place 1.7 changes behavior Sim relies on is adapted so connects, sign-ins, the MCP OAuth provider and enterprise SSO keep working. Dependencies - @better-auth/core calls z.validate, added in zod 4.5; the root override keeps zod on 4.3.6, so a version-pinned patch restores 1.6's safeParse form. - The global @xmldom/xmldom 0.8.15 override is dropped: @better-auth/sso needs 0.9.12, and samlify, xml-crypto, mammoth, officeparser and plist keep 0.8.15. - The oauth-provider 1.6.27 resource patch is obsolete and removed. Integration connectors - Generic OAuth no longer serves /oauth2/*; the registered /api/auth/oauth2/callback/:id URIs are forwarded to core's /callback/:id, so no provider registration changes. Clients link through linkSocial. - Custom getToken uses the registered redirect URI; Google connectors use explicit endpoints instead of discovery; scope rewrites move into the token exchange; reserved authorization params (scope, nonce) are passed as options; pkce stays off where it was off. - Connector callbacks only complete an authenticated link and never sign up or sign in a user; linking counts the profile email as verified. - Account hooks identify connector callbacks by the account's provider, since hook contexts carry the route pattern. MCP OAuth provider - Resources stay out of 1.7's static resource model via a signed sim_resource parameter; public clients are recognized by token_endpoint_auth_method none; dynamic registration infers the application type; registrations keep their requested scopes; DPoP is refused and metadata advertises only what Sim honors; access tokens revoked at sign-out are rejected. - Migration 0447 adds 1.7's columns and tables expand-only, so 1.6 and 1.7 pods share the schema during rollout. Runtime schema validation is off because migrations own Sim's schema. Enterprise SSO - The legacy SAML ACS URL is forwarded to /sso/saml2/sp/acs/:id, so IdPs need no change; new providers advertise the new URL. - Registration matches 1.7's strict schemas (no mapping.id; idpMetadata as metadata or entityID) and checks 1.7's sign-in policy on save. - Migration 0448 spells out entityID for certificate-only providers and clears wantAssertionsSigned where the SP metadata never asked for signed assertions, keeping 1.6's accept-any-IdP-signature policy. - POST sign-in/email-otp is refused: 1.7 deletes every linked account of an unverified user there.

…the new test calls

…ute test

… migration 0448 - Keep the SSO plugin's parsed registration body, as before 1.7. - Compare issuers exactly when carrying over a token auth method. - Surface linkSocial start errors in the connect hook and desktop launcher. - Accept whitespace around WantAssertionsSigned in migration 0448 and the script. - The register script refuses custom SP metadata that contradicts its signing flag and prints the stored SAML ACS URL.

…ing token families Better Auth 1.7 revokes a replayed code's tokens by authorizationCodeId outside any transaction. The adapter guard now deletes the grant's token families (cascading to its tokens) and refuses an access-token insert whose refresh token a concurrent replay already removed as invalid_grant instead of a 500.

…ript SAML audiences working on Better Auth 1.7 - Forward a client's Basic credentials to Better Auth unchanged; 1.7 decodes them itself and refuses a client_secret_basic client that arrives through the body - Drop a client's dpop_jkt instead of refusing the authorization request, matching 1.6, since Sim issues bearer tokens only - Allow IdP-initiated SAML, which 1.7 turns off by default; correct the docs that said it was rejected - Migration 0448 drops a SAML audience equal to the IdP's own entity ID (the registration script's old default), which 1.7 now enforces exclusively; the script now leaves audience unset - Order migration 0447's ALTERs the way token issuance locks the tables - Turn off Better Auth's runtime schema check in the realtime one-time-token verifier - Share one issuer normalizer across SSO, accept either quote in WantAssertionsSigned, and tidy comments

waleedlatif1 · 2026-10-30T06:45:58Z

@greptile

waleedlatif1 · 2026-10-30T06:46:00Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T06:46:05Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 82 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 requested a review from a team as a code owner October 30, 2026 04:01

vercel Bot temporarily deployed to Preview October 30, 2026 04:07 Inactive

greptile-apps Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread packages/db/migrations/0448_sso_saml_signin_authority.sql Resolved

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview October 30, 2026 04:32 Inactive

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

waleedlatif1 added 7 commits October 29, 2026 23:28

chore(deps): shrink the explicit-any baseline for connector providers

a71eb91

fix(auth): type the SSO token-auth selector against 1.7's config and …

87ff646

…the new test calls

chore(deps): shrink the test-types baseline for the auth catch-all ro…

29b171e

…ute test

waleedlatif1 force-pushed the chore/better-auth-1-7 branch from 5ba954d to f403950 Compare October 30, 2026 06:45

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

vercel Bot deployed to Preview October 30, 2026 06:52

View deployment

📋 Server Request & Proxy Logs

⚙️ Pengaturan Proxy Target

Conversation

waleedlatif1 commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Oct 30, 2026 •

edited

Loading

vercel Bot commented Oct 30, 2026 •

edited

Loading

greptile-apps Bot commented Oct 30, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading