Restrict organization creation by user
Set allowUserToCreateOrganization option to a function that returns a boolean or directly to true/false. The function receives the user object and can implement custom logic, such as checking subscription tier.
Better Auth · Plugins · all subjects
organization/access-control
12 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Default organization roles
By default, organizations have three roles: owner (full control, created the organization), admin (full control except deleting organization or changing owner), member (read-only, no permissions to create/update/delete resources). Users can have multiple roles stored as comma-separated strings.
Default organization permissions
Default resources and actions: organization (update, delete), member (create, update, delete), invitation (create, cancel). Owner has full control. Admin has full control except organization deletion and owner changes. Member has no control and can only read data.
Create custom access control
Import createAccessControl from 'better-auth/plugins/access'. Define statement object with resource names as keys and action arrays as values (use 'as const'). Call createAccessControl(statement) to create access controller instance.
Create custom roles
After creating access controller, call ac.newRole() to define custom roles with specific permissions. To override predefined roles, import defaultStatements and merge with new statement, plus merge role permissions with default roles.
Pass custom roles to plugins
Pass ac (access controller) and roles object to organization plugin in betterAuth config. Also pass ac and roles to organizationClient in client plugin config.
Check user permission on server
Call auth.api.hasPermission() with headers and body containing permissions object. Can check single or multiple resource permissions simultaneously.
Check user permission on client
Call authClient.organization.hasPermission() with permissions object containing resources and actions to check. Can check single or multiple resource permissions simultaneously.
Check role permission client-side
Call authClient.organization.checkRolePermission() with permissions object and role string. Runs synchronously on client, so does not include dynamic roles. For dynamic roles, use hasPermission() APIs.
Dynamic access control configuration
Enable dynamic access control by passing dynamicAccessControl: { enabled: true } to both server organization plugin and client organizationClient. Requires pre-defined ac instance on server. Requires running migrations to add organizationRole table.
Dynamic access control maximumRolesPerOrganization option
Set maximumRolesPerOrganization in dynamicAccessControl config to limit roles per organization. Default is infinite. Can be a number or async function receiving organizationId and returning a number (e.g., based on organization plan).
Team permissions default
Teams follow organization permission system. Required permissions: team:create, team:update, team:delete. By default, only organization owners and admins can manage teams. Regular members cannot create, update, or delete teams.