chore(deps): upgrade better-auth to 1.7.12 by waleedlatif1 · Pull Request #9465 · simstudioai/sim

waleedlatif1 · 2026-10-30T04:01:11Z

Summary

Moves better-auth, @better-auth/oauth-provider, @better-auth/sso, @better-auth/stripe (and packages/auth) from 1.6.27 to 1.7.12. 1.7.7+ fixes the magic-link, OAuth-proxy, device-authorization and DB rate-limit advisories (not reachable today, but 1.6 gets no fixes). Each 1.7 behavior change Sim depends on is adapted, following the 1.7 upgrade guide.

Dependencies

@better-auth/core calls z.validate (zod 4.5+); the root override keeps zod at 4.3.6, so every sign-in would throw. Version-pinned patch restores 1.6's safeParse form (documented in patches/README.md)
Dropped the global @xmldom/xmldom 0.8.15 override: sso 1.7 needs 0.9.12 (onError), while samlify/xml-crypto/mammoth/officeparser/plist keep 0.8.15 (0.9 throws without a MIME type)
Removed the obsolete oauth-provider 1.6.27 resource patch

Integration connectors (generic OAuth lost its /oauth2/* endpoints)

Registered /api/auth/oauth2/callback/:id URIs are forwarded to core /callback/:id — no provider re-registration
Client links via linkSocial; custom getToken keeps the registered redirect URI; Google connectors use explicit endpoints instead of discovery; scope rewrites moved into the token exchange; reserved authorize params (scope, nonce) passed as options; pkce: false kept explicit where 1.6 had it off
Connector callbacks only complete an authenticated link and never sign up/in a user (core doesn't bind state to a provider, so a replayed sign-in state could otherwise sign in whoever owns the email a connector reports)
Account hooks identify connector callbacks by the account's provider — hook contexts carry the route pattern, so the old path check would have skipped credential creation

MCP OAuth provider

Dynamic resources stay out of 1.7's static resource model via a signed sim_resource param
Public clients recognized by token_endpoint_auth_method: none (1.7 dropped public); registration infers app type so loopback/cursor:// callbacks still register; requested scopes are kept; DPoP refused; metadata advertises only what Sim honors; tokens revoked at sign-out are rejected
Migration 0447: expand-only columns/tables, so 1.6 and 1.7 pods share the schema during rollout; runtime schema validation off (migrations own the schema)

Enterprise SSO

Legacy SAML ACS URL forwarded to /sso/saml2/sp/acs/:id (POST and GET), so IdPs need no change; new providers advertise the new URL
Registration matches 1.7's strict schemas (no mapping.id; idpMetadata as metadata or entityID) and checks 1.7's sign-in policy on save
Migration 0448 (data, idempotent): writes entityID for cert-only providers, and clears wantAssertionsSigned where SP metadata never asked for signed assertions — keeping 1.6's accept-any-IdP-signature policy so IdPs that sign only the Response keep working
POST sign-in/email-otp refused: 1.7 deletes every linked account of an unverified user there

Behavior changes to expect

In-flight OAuth/SSO/MCP authorizations that span the 1.6→1.7 cutover fail once (state key format changed); retry works
SSO account ids now always come from OIDC sub / SAML NameID; providers that mapped another id claim re-link by email on their verified domain (new account row, same user)
OIDC SSO ID tokens are now always verified, so the stored issuer must match iss exactly
Browser sign-out revokes session-bound MCP access tokens; refresh tokens (offline_access) survive

Type of Change

Dependency update / security

Testing

Unit/route tests for every touched area: ~3,000 tests across auth, SSO, OAuth, credentials, credential groups, contracts
17 auth-related integration files on disposable Postgres with all migrations (189 tests): token route, provider lifecycle, token family, lifecycle audit, SSO settings/admission/concurrency/primary provider, credential groups, reconnect conflict, credential revocation, shopify. The reconnect test caught the hook-path issue above
Migration 0448 run twice on fixture rows (cert-only, XML, already-strict, legacy string, bad JSON, non-object, OIDC): correct and idempotent
drizzle-kit generate clean, check:migrations, biome; full type-check and audits run in CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Moves better-auth, @better-auth/oauth-provider, @better-auth/sso and @better-auth/stripe (and packages/auth) from 1.6.27 to 1.7.12, which carries the 1.7.7 fixes for the magic-link, OAuth proxy, device-authorization and rate-limit advisories. Each place 1.7 changes behavior Sim relies on is adapted so connects, sign-ins, the MCP OAuth provider and enterprise SSO keep working. Dependencies - @better-auth/core calls z.validate, added in zod 4.5; the root override keeps zod on 4.3.6, so a version-pinned patch restores 1.6's safeParse form. - The global @xmldom/xmldom 0.8.15 override is dropped: @better-auth/sso needs 0.9.12, and samlify, xml-crypto, mammoth, officeparser and plist keep 0.8.15. - The oauth-provider 1.6.27 resource patch is obsolete and removed. Integration connectors - Generic OAuth no longer serves /oauth2/*; the registered /api/auth/oauth2/callback/:id URIs are forwarded to core's /callback/:id, so no provider registration changes. Clients link through linkSocial. - Custom getToken uses the registered redirect URI; Google connectors use explicit endpoints instead of discovery; scope rewrites move into the token exchange; reserved authorization params (scope, nonce) are passed as options; pkce stays off where it was off. - Connector callbacks only complete an authenticated link and never sign up or sign in a user; linking counts the profile email as verified. - Account hooks identify connector callbacks by the account's provider, since hook contexts carry the route pattern. MCP OAuth provider - Resources stay out of 1.7's static resource model via a signed sim_resource parameter; public clients are recognized by token_endpoint_auth_method none; dynamic registration infers the application type; registrations keep their requested scopes; DPoP is refused and metadata advertises only what Sim honors; access tokens revoked at sign-out are rejected. - Migration 0447 adds 1.7's columns and tables expand-only, so 1.6 and 1.7 pods share the schema during rollout. Runtime schema validation is off because migrations own Sim's schema. Enterprise SSO - The legacy SAML ACS URL is forwarded to /sso/saml2/sp/acs/:id, so IdPs need no change; new providers advertise the new URL. - Registration matches 1.7's strict schemas (no mapping.id; idpMetadata as metadata or entityID) and checks 1.7's sign-in policy on save. - Migration 0448 spells out entityID for certificate-only providers and clears wantAssertionsSigned where the SP metadata never asked for signed assertions, keeping 1.6's accept-any-IdP-signature policy. - POST sign-in/email-otp is refused: 1.7 deletes every linked account of an unverified user there.

vercel · 2026-10-30T04:01:14Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 30, 2026 4:32am UTC

…the new test calls

greptile-apps · 2026-10-30T04:07:03Z

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge with the acknowledged SAML rollout repair deferred to the next release.

Summary

Upgrades Better Auth and its plugins to 1.7.12, with changes for connector linking, MCP OAuth, SSO, and the shared database.

Integration connectors keep their registered callback URLs while using the new link flow.
MCP clients keep using dynamic resource URLs with the updated OAuth provider.
Enterprise SSO keeps existing SAML callbacks working with the new provider rules.
The authentication packages move to Better Auth 1.7.12 with compatibility changes for Sim.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Replay[Authorization code replay] --> Delete[Delete matching token families]
  Delete --> Refresh[Refresh tokens deleted]
  Refresh --> Access[Linked access tokens deleted]
  Insert[Concurrent access-token insert] --> Missing{Refresh token still exists?}
  Missing -->|No| Refuse[Return invalid_grant]
  Missing -->|Yes| Complete[Complete exchange]
  Refuse --> Cleanup[Remove tracked families]

_{Reviews (3) · Last reviewed commit: "fix(auth): clean up replayed authorizati..." · Reviewed by Greptile}

cubic-dev-ai

Review completed against the latest diff

_{This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic}

…ute test

… migration 0448 - Keep the SSO plugin's parsed registration body, as before 1.7. - Compare issuers exactly when carrying over a token auth method. - Surface linkSocial start errors in the connect hook and desktop launcher. - Accept whitespace around WantAssertionsSigned in migration 0448 and the script. - The register script refuses custom SP metadata that contradicts its signing flag and prints the stored SAML ACS URL.

waleedlatif1 · 2026-10-30T04:17:40Z

@greptile

waleedlatif1 · 2026-10-30T04:17:42Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T04:17:48Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 77 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

…ing token families Better Auth 1.7 revokes a replayed code's tokens by authorizationCodeId outside any transaction. The adapter guard now deletes the grant's token families (cascading to its tokens) and refuses an access-token insert whose refresh token a concurrent replay already removed as invalid_grant instead of a 500.

waleedlatif1 · 2026-10-30T04:32:09Z

@greptile

waleedlatif1 · 2026-10-30T04:32:10Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T04:32:15Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 77 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 requested a review from a team as a code owner October 30, 2026 04:01

waleedlatif1 added 2 commits October 29, 2026 21:04

chore(deps): shrink the explicit-any baseline for connector providers

89f0d57

fix(auth): type the SSO token-auth selector against 1.7's config and …

cf7c899

…the new test calls

vercel Bot temporarily deployed to Preview October 30, 2026 04:07 Inactive

greptile-apps Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread packages/db/migrations/0448_sso_saml_signin_authority.sql

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

waleedlatif1 added 2 commits October 29, 2026 21:12

chore(deps): shrink the test-types baseline for the auth catch-all ro…

7a19dd6

…ute test

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview October 30, 2026 04:32 Inactive

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

Conversation

waleedlatif1 commented Oct 30, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 30, 2026 •

edited

Loading

greptile-apps Bot commented Oct 30, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading