Skip to content

fix: access control indexing type#8155

Merged
himself65 merged 2 commits intobetter-auth:canaryfrom
YevheniiKotyrlo:fix/type-declaration-bugs
Mar 3, 2026
Merged

fix: access control indexing type#8155
himself65 merged 2 commits intobetter-auth:canaryfrom
YevheniiKotyrlo:fix/type-declaration-bugs

Conversation

@YevheniiKotyrlo
Copy link
Copy Markdown
Contributor

@YevheniiKotyrlo YevheniiKotyrlo commented Feb 25, 2026

Summary

Two source-level type fixes for consumers with skipLibCheck: false:

1. Remove zod/v4/core re-export from src/index.ts

The line export type * from "zod/v4/core" overlaps with export type * from "zod/v4" and leaks internal Zod types into the public API namespace. This causes TS2742 ("cannot be named without a reference to zod/v4/core") for consumers. The line already has @ts-expect-error above it, confirming it was known to be problematic.

Related: #5574, #4837

2. Fix access control [key][number] indexing in admin and organization plugins

The emitted .d.ts for permission types uses S[key][number] double-indexing, but TypeScript cannot narrow the intermediate [key] access to readonly unknown[] after the conditional check. This produces type errors in the emitted declarations for both admin and organization plugin client types.

Fix: introduce an ArrayElement<T> helper type (T extends readonly (infer E)[] ? E : never) and use ArrayElement<S[key]> instead of S[key][number] in 4 locations (admin/client.ts, admin/routes.ts, organization/client.ts, organization/organization.ts).

Related: #4804, #6491, #6127

Impact

  • Runtime: Zero — types only, no behavioral changes
  • Build: pnpm typecheck, pnpm lint, pnpm build all pass
  • Consumers: Fixes TS2742 and access control type errors for projects using skipLibCheck: false

Verification

  • pnpm typecheck — zero errors
  • pnpm lint (Biome, 1386 files) — no issues
  • pnpm build (tsdown, 673 output files) — clean in ~1100ms

Summary by cubic

Fix TypeScript declaration issues by removing the zod/v4/core type re-export and using a new ArrayElement helper for permission arrays. This resolves TS2742 and permission type errors for projects using skipLibCheck: false.

  • Bug Fixes
    • Removed export type * from "zod/v4/core" to prevent internal Zod types leaking and “cannot be named” errors.
    • Added ArrayElement helper in access/types and used it in admin and organization permission types (replacing S[key][number]) to fix emitted d.ts.

Written for commit e0036d5. Summary will update on new commits.

@vercel
Copy link
Copy Markdown

vercel bot commented Feb 25, 2026

@YevheniiKotyrlo is attempting to deploy a commit to the better-auth Team on Vercel.

A member of the Team first needs to authorize it.

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Feb 25, 2026

Open in StackBlitz

@better-auth/api-key

npm i https://pkg.pr.new/@better-auth/api-key@8155

better-auth

npm i https://pkg.pr.new/better-auth@8155

auth

npm i https://pkg.pr.new/auth@8155

@better-auth/core

npm i https://pkg.pr.new/@better-auth/core@8155

@better-auth/drizzle-adapter

npm i https://pkg.pr.new/@better-auth/drizzle-adapter@8155

@better-auth/electron

npm i https://pkg.pr.new/@better-auth/electron@8155

@better-auth/expo

npm i https://pkg.pr.new/@better-auth/expo@8155

@better-auth/i18n

npm i https://pkg.pr.new/@better-auth/i18n@8155

@better-auth/kysely-adapter

npm i https://pkg.pr.new/@better-auth/kysely-adapter@8155

@better-auth/memory-adapter

npm i https://pkg.pr.new/@better-auth/memory-adapter@8155

@better-auth/mongo-adapter

npm i https://pkg.pr.new/@better-auth/mongo-adapter@8155

@better-auth/oauth-provider

npm i https://pkg.pr.new/@better-auth/oauth-provider@8155

@better-auth/passkey

npm i https://pkg.pr.new/@better-auth/passkey@8155

@better-auth/prisma-adapter

npm i https://pkg.pr.new/@better-auth/prisma-adapter@8155

@better-auth/redis-storage

npm i https://pkg.pr.new/@better-auth/redis-storage@8155

@better-auth/scim

npm i https://pkg.pr.new/@better-auth/scim@8155

@better-auth/sso

npm i https://pkg.pr.new/@better-auth/sso@8155

@better-auth/stripe

npm i https://pkg.pr.new/@better-auth/stripe@8155

@better-auth/telemetry

npm i https://pkg.pr.new/@better-auth/telemetry@8155

@better-auth/test-utils

npm i https://pkg.pr.new/@better-auth/test-utils@8155

commit: c993f3e

Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 6 files

@himself65 himself65 changed the title fix(types): remove zod/v4/core re-export and fix access control indexing fix: remove zod/v4/core re-export and fix access control indexing Feb 26, 2026
Copy link
Copy Markdown
Contributor

@himself65 himself65 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want merge this after: #8021

@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Feb 26, 2026

CLA assistant check
All committers have signed the CLA.

@himself65 himself65 changed the title fix: remove zod/v4/core re-export and fix access control indexing fix: access control indexing type Mar 3, 2026
Two source-level type fixes:

1. Remove `export type * from "zod/v4/core"` from src/index.ts. The line
   already has @ts-expect-error and the re-export overlaps with
   `export type * from "zod/v4"`, leaking internal types that cause TS2742
   "cannot be named" errors for consumers with skipLibCheck: false.

2. Replace S[key][number] with ArrayElement<S[key]> in access control types.
   TypeScript cannot narrow the intermediate [key] access to readonly unknown[]
   after the conditional check, causing type errors in emitted .d.ts for admin
   and organization plugin permission types.
@himself65 himself65 force-pushed the fix/type-declaration-bugs branch from 52416f9 to 8e062fc Compare March 3, 2026 04:00
@himself65 himself65 enabled auto-merge March 3, 2026 04:15
@himself65 himself65 added this pull request to the merge queue Mar 3, 2026
Merged via the queue into better-auth:canary with commit 47bba48 Mar 3, 2026
19 of 21 checks passed
himself65 added a commit that referenced this pull request Mar 3, 2026
Co-authored-by: Alex Yang <himself65@outlook.com>
himself65 added a commit that referenced this pull request Mar 3, 2026
Co-authored-by: Alex Yang <himself65@outlook.com>
@better-auth better-auth locked as resolved and limited conversation to collaborators Mar 31, 2026
@bytaesu bytaesu added the locked Locked conversations after being closed for 7 days label Mar 31, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

locked Locked conversations after being closed for 7 days

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants