Skip to content

fix: Patch better-auth to force delete image of the session cache #727

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elie222 merged 1 commit into from
Aug 29, 2025
Merged

fix: Patch better-auth to force delete image of the session cache #727

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@
"overrides": {
"@types/react": "19.0.10",
"@types/react-dom": "19.0.4"
},
"patchedDependencies": {
"better-auth@1.3.4": "patches/better-auth@1.3.4.patch"
}
Comment on lines 33 to 39
Copy link
Contributor

@coderabbitai coderabbitai bot Aug 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Commit the updated lockfile and verify the patch is wired.

Ensure pnpm-lock.yaml captures the patch; otherwise CI or new installs may miss it.

🏁 Script executed:

#!/bin/bash
set -euo pipefail
LOCK="$(fd -H --max-depth 1 '^pnpm-lock\.yaml$' | head -n1)"
if [[ -z "${LOCK}" ]]; then
  echo "pnpm-lock.yaml not found at repo root"; exit 1
fi

echo "Checking lockfile for patched better-auth@1.3.4…"
rg -nC2 -F 'patch:better-auth@1.3.4' "$LOCK" || { echo "Patch not recorded in lockfile"; exit 2; }
rg -nC2 -F 'patchedDependencies:' "$LOCK" || echo "Note: lockfile format may differ; manually confirm patch entry."

echo "Verifying patch file path exists…"
test -f patches/better-auth@1.3.4.patch || { echo "Patch file missing"; exit 3; }
echo "OK"

Length of output: 361

Commit updated lockfile with patch entry
pnpm-lock.yaml is missing the patch:better-auth@1.3.4 entry; run pnpm install, commit the updated pnpm-lock.yaml to include it, and confirm patches/better-auth@1.3.4.patch exists so the patch is wired.

🤖 Prompt for AI Agents 
In package.json around lines 33 to 39, you added a patchedDependencies entry for
better-auth@1.3.4 but did not update pnpm-lock.yaml; run `pnpm install` locally
to regenerate the lockfile so it includes the `patch:better-auth@1.3.4` entry,
verify that `patches/better-auth@1.3.4.patch` exists in the repo, then commit
the updated pnpm-lock.yaml (and the patch file if missing) so the patch is
correctly wired.

🛠️ Refactor suggestion

Pin better-auth to 1.3.4 in pnpm.overrides so the patch always applies.

Without an override, a transitive resolution to a different better-auth version will bypass the patch.

Apply:

   "pnpm": {
     "overrides": {
+      "better-auth": "1.3.4",
       "@types/react": "19.0.10",
       "@types/react-dom": "19.0.4"
     },
     "patchedDependencies": {
       "better-auth@1.3.4": "patches/better-auth@1.3.4.patch"
     }
   }

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In package.json around lines 33 to 39, add an override that pins better-auth to
version 1.3.4 so the patch always applies: update the existing overrides map to
include "better-auth": "1.3.4" (alongside the @types entries) and save; this
ensures pnpm will always resolve better-auth@1.3.4 and the patchedDependencies
entry will be used.

}
}
12 changes: 12 additions & 0 deletions patches/better-auth@1.3.4.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
diff --git a/dist/cookies/index.mjs b/dist/cookies/index.mjs
index f4c53b8b90f61589ffe873e22d756bf081144f2f..993b62d63705fe3ffee1bfea69386d939b482c77 100644
--- a/dist/cookies/index.mjs
+++ b/dist/cookies/index.mjs
@@ -259,6 +259,7 @@ async function setCookieCache(ctx, session) {
},
{}
);
+ session.user.image = null;
const sessionData = { session: filteredSession, user: session.user };
const expiresAtDate = getDate(
ctx.context.authCookies.sessionData.options.maxAge || 60,
Comment on lines +1 to +12
Copy link
Contributor

@coderabbitai coderabbitai bot Aug 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Regenerate the patch rather than hand-editing to keep headers consistent.

After changing the hunk, use pnpm patch / patch-commit to re-create the patch so it applies cleanly across environments.

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "Quick sanity check: ensure the patch reflects 'userWithoutImage' lines"
rg -nC2 'userWithoutImage' patches/better-auth@1.3.4.patch || { echo "Patch not updated"; exit 1; }

Length of output: 289

Regenerate the patch using pnpm patch / patch-commit
Hand-editing dropped the intended userWithoutImage changes and misaligned headers. Recreate the patch via the patch tool so it cleanly includes the proper hunk.

🤖 Prompt for AI Agents 
In patches/better-auth@1.3.4.patch around lines 1 to 12, the hand-edited diff
replaced the intended userWithoutImage logic with a direct assignment
(session.user.image = null) and misaligned hunk headers; regenerate the patch
using the repo's patch tooling (pnpm patch or patch-commit) so the proper
transformation that creates userWithoutImage (or equivalent filtered user
object) is preserved, ensure the diff hunk headers and context lines are
correct, and commit the regenerated patch file instead of hand-editing.

Comment on lines +5 to +12
Copy link
Contributor

@coderabbitai coderabbitai bot Aug 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

⚠️ Potential issue

Avoid mutating session.user; safely omit image from the cached payload.

Current code sets session.user.image = null, which:

  • Mutates the input (possible side effects if the object is reused).
  • Retains an "image": null key, wasting bytes.
  • Can throw if session.user is undefined.

Update the patch to construct a user object without image:

@@ -259,6 +259,7 @@ async function setCookieCache(ctx, session) {
       },
       {}
     );
-+    session.user.image = null;
-+    const sessionData = { session: filteredSession, user: session.user };
++    const user = session.user ?? {};
++    const { image: _omit, ...userWithoutImage } = user;
++    const sessionData = { session: filteredSession, user: userWithoutImage };
     const expiresAtDate = getDate(
       ctx.context.authCookies.sessionData.options.maxAge || 60,

This removes the image field entirely, minimizes cookie size, and avoids side effects.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@@ -259,6 +259,7 @@ async function setCookieCache(ctx, session) {
},
{}
);
+ session.user.image = null;
const sessionData = { session: filteredSession, user: session.user };
const expiresAtDate = getDate(
ctx.context.authCookies.sessionData.options.maxAge || 60,
@@ async function setCookieCache(ctx, session) {
},
{}
);
const user = session.user ?? {};
const { image: _omit, ...userWithoutImage } = user;
const sessionData = { session: filteredSession, user: userWithoutImage };
const expiresAtDate = getDate(
ctx.context.authCookies.sessionData.options.maxAge || 60,
);
// …
}
🤖 Prompt for AI Agents 
In patches/better-auth@1.3.4.patch around lines 5 to 12, the change mutates
session.user.image = null; instead construct a new user object that omits the
image property and use that in sessionData instead of mutating the original
(e.g. if session.user is defined, create a shallow copy that excludes image and
assign that to the user field; if session.user is undefined keep it undefined),
then pass { session: filteredSession, user: safeUser } to sessionData so you
avoid side effects, possible errors when user is undefined, and the extra null
field in the cookie payload.

9 changes: 7 additions & 2 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading