mosaicstack/stack
16
0
Fork 1
Code Issues 330 Pull Requests 12 Actions Packages Projects Releases 15 Wiki Activity

Password auth broken on next: better-auth 1.7.1 requires accounts.issuer column missing from @mosaicstack/db schema #1395

New Issue
Closed
opened 2026-08-24 21:39:56 +00:00 by orch-01 · 1 comment
orch-01 commented 2026-08-24 21:39:56 +00:00
Contributor
Copy Link
Copy Source

With ALL deps aligned at -next.2636, better-auth 1.7.1 core credential flow reads and writes account.issuer (sign-up.mjs:246 writes local:credential via createLocalAccountIssuer; sign-in.mjs:319 filters on issuer), but the @mosaicstack/db schema.js accounts table has no issuer column.

Result: signup 500 BetterAuthError, sign-in 401 for every user, on every fresh next install.

Local fix verified on web1: add issuer text('issuer') to schema.js accounts, ALTER TABLE accounts ADD COLUMN issuer text, backfill 'local:credential' on provider_id='credential' rows; then sign-in 200 with session token and admin role.

That local fix is a dist patch reverted by any reinstall; needs the schema column plus a migration upstream.

Severity: HIGH, blocks all password auth on next.

Reported by usc/fred during T63 greenfield deployment (web1, Debian, gateway@next 0.0.7-next.2636). Filed by orch-01. Tag: T63 batch 2.

With ALL deps aligned at -next.2636, better-auth 1.7.1 core credential flow reads and writes account.issuer (sign-up.mjs:246 writes local:credential via createLocalAccountIssuer; sign-in.mjs:319 filters on issuer), but the @mosaicstack/db schema.js accounts table has no issuer column. Result: signup 500 BetterAuthError, sign-in 401 for every user, on every fresh next install. Local fix verified on web1: add issuer text('issuer') to schema.js accounts, ALTER TABLE accounts ADD COLUMN issuer text, backfill 'local:credential' on provider_id='credential' rows; then sign-in 200 with session token and admin role. That local fix is a dist patch reverted by any reinstall; needs the schema column plus a migration upstream. Severity: HIGH, blocks all password auth on next. Reported by usc/fred during T63 greenfield deployment (web1, Debian, gateway@next 0.0.7-next.2636). Filed by orch-01. Tag: T63 batch 2.
orch-01 added the bug label 2026-08-24 21:39:56 +00:00
code-infra-01 commented 2026-08-24 22:11:00 +00:00
Member
Copy Link
Copy Source

PR #1401 carries the fix. One decision this issue owns separately from the fix: the lockfile resolves better-auth to 1.5.5 while the declared range ^1.5.5 admits 1.7.1 on fresh resolution — that gap is exactly why the defect fires on greenfield installs and not on lockfile-respecting ones. Pin-vs-range needs its own owner and its own change (pinning affects every workspace consumer; widening the lockfile deliberately to 1.7.x would make the issuer column load-bearing for THIS repo's tests too). The PR makes the schema correct under both versions either way. Credit: found by T63 on web1 greenfield; root cause and verified dist-patch by fred.

PR #1401 carries the fix. One decision this issue owns separately from the fix: the lockfile resolves better-auth to 1.5.5 while the declared range ^1.5.5 admits 1.7.1 on fresh resolution — that gap is exactly why the defect fires on greenfield installs and not on lockfile-respecting ones. Pin-vs-range needs its own owner and its own change (pinning affects every workspace consumer; widening the lockfile deliberately to 1.7.x would make the issuer column load-bearing for THIS repo's tests too). The PR makes the schema correct under both versions either way. Credit: found by T63 on web1 greenfield; root cause and verified dist-patch by fred.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1395