Using access control with the organisation client causes a huge bundle size. #7637
Description
Is this suited for github?
- Yes, this is suited for github
To Reproduce
- Create a better-auth instance as shown in the docs using any framework with a bundler.
- Add the organisation plugin to the server.
- Add the organisationClient plugin to the client.
Create custom access control e.g.:
import { createAccessControl } from 'better-auth/plugins';
import {
adminAc,
defaultStatements,
memberAc,
ownerAc
} from 'better-auth/plugins/organization/access';
export const statement = {
...defaultStatements,
site: ['create', 'update', 'delete'],
} as const;
export const ac = createAccessControl(statement);
export const owner = ac.newRole({
...ownerAc.statements,
site: ['create', 'update', 'delete'],
});
export const admin = ac.newRole({
...adminAc.statements,
site: ['create', 'update', 'delete']
});
export const editor = ac.newRole({
...memberAc.statements,
site: ['update']
});
export const member = ac.newRole({
...memberAc.statements
});- Doing as the docs say, import this file both into the server and the client.
- Watch your client bundle size explode!
Current vs. Expected behavior
The current behaviour is that using access control on the client causes server dependencies to be pulled into the client. This should either be resolved or an alternative package for defining access control on the client should be provided.
What version of Better Auth are you using?
1.4.17
System info
{
"system": {
"platform": "darwin",
"arch": "arm64",
"version": "Darwin Kernel Version 25.2.0: Tue Nov 18 21:08:48 PST 2025; root:xnu-12377.61.12~1/RELEASE_ARM64_T8132",
"release": "25.2.0",
"cpuCount": 10,
"cpuModel": "Apple M4",
"totalMemory": "16.00 GB",
"freeMemory": "0.15 GB"
},
"node": {
"version": "v25.4.0",
"env": "development"
},
"packageManager": {
"name": "pnpm",
"version": "10.28.1"
},
"frameworks": [
{
"name": "svelte",
"version": "^5.46.4"
},
{
"name": "@sveltejs/kit",
"version": "^2.49.5"
}
],
"databases": [
{
"name": "pg",
"version": "^8.17.2"
},
{
"name": "drizzle",
"version": "^1.0.0-beta.12-a5629fb"
}
],
"betterAuth": {
"version": "^1.4.17",
"config": null
}
}Which area(s) are affected? (Select all that apply)
Client, Backend
Auth config (if applicable)
import { betterAuth } from 'better-auth/minimal';
import { drizzleAdapter } from '@better-auth/drizzle-adapter';
import { db } from '../db/db';
import { sveltekitCookies } from 'better-auth/svelte-kit';
import { getRequestEvent } from '$app/server';
import * as authSchema from '../db/schema/auth-schema';
import { admin, organization } from 'better-auth/plugins';
import {
ac,
admin as adminRole,
approver,
inviter,
member,
office,
owner,
siteManager
} from '$lib/permissions';
export const auth = betterAuth({
emailAndPassword: {
enabled: true
},
plugins: [
admin(),
organization({
teams: { enabled: false },
ac,
roles: {
owner,
admin: adminRole,
approver,
office,
siteManager,
inviter,
member
}
}),
sveltekitCookies(getRequestEvent)
],
database: drizzleAdapter(db, {
provider: 'pg',
schema: authSchema
})
});Additional context
Removing the access control from the client causes the bundle to shrink down as expected, but without the niceties of typescript typing.