Skip to content

Plan oauth-provider migration (#1) #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
smart wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Plan oauth-provider migration (#1) #380

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5c6588b
Plan oauth-provider migration (#1)
smart May 19, 2026
6e8a4df
Address OAuth provider review feedback
cursoragent May 20, 2026
3a66f86
Add prepare script for git installs (#2)
smart May 20, 2026
581efd3
Remove prepare script
cursoragent May 20, 2026
1e89632
Merge pull request #4 from BandWithUs/cursor/remove-prepare-script-e2fc
smart May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,29 @@
# Changelog

## Unreleased

- feat: migrate the Convex plugin from Better Auth's deprecated
`oidc-provider` integration to `@better-auth/oauth-provider`.
- feat: add Convex-friendly MCP helper exports:
`withMcpAuth`, `oAuthDiscoveryMetadata`, and
`oAuthProtectedResourceMetadata`.
- feat: expose OAuth/OIDC discovery routes and `WWW-Authenticate` CORS headers
for MCP/OAuth clients.
- chore: pin `better-auth` and `@better-auth/oauth-provider` to `1.6.11`.

Migration notes:

- Regenerate local Better Auth schemas after upgrading.
- Existing `oauthApplication` / legacy `oidcApplication` rows must be migrated
to the new `oauthClient` table shape. Existing OAuth access and refresh
tokens should be invalidated and clients should reauthorize.
- Configure first-party clients that need seamless authorization with
`skip_consent: true`; configure clients that need RP-initiated logout with
`enable_end_session: true` and `post_logout_redirect_uris`.
- Set a stable Convex environment variable for `pairwiseSecret` before enabling
pairwise subject identifiers. Rotating this secret changes pairwise `sub`
values.

## 0.12.2

- fix: strip hop-by-hop headers in framework proxy handlers (#360) @CipherSight
Expand Down
Loading