Upgrade to Better Auth 1.7

[wasimxyz]

Summary

npm audit fix pulled Better Auth from 1.6.27 to 1.7.2. That is a breaking upgrade, and it broke three things: email sign-in, MCP OAuth, and the type check. This PR finishes the upgrade so all three work again.

Three unrelated runs-list changes were already in flight on this branch and rode along. They are described at the bottom.

What 1.7 broke

Email sign-in. 1.7 looks accounts up by issuer and account ID together. Existing rows had no issuer, so signing in failed with "user not found". Migration 0043_add_account_issuer.sql adds the column, fills it in for existing rows, then makes it required and unique.

MCP OAuth. 1.7 reshaped the OAuth provider tables and ours were never regenerated, so registering a client returned a 500 and no MCP client could connect. Migration 0044_better_auth_17_oauth_tables.sql adds 18 missing columns and three new tables, and drops nothing. The validAudiences setting was removed in 1.7, so the MCP audience is now a seeded row in the new oauth_resource table. scripts/generate-auth-schema.ts knows about the new tables, so the next regeneration keeps them.

The type check. verifyAccessToken was renamed to verifyBearerToken.

Drive-by changes

Wide tables. Wide instrument tables (SpectraMax, Gel Doc) stretched the whole page sideways instead of scrolling inside their own card. The table already had its own horizontal scroll, but the panes around it were allowed to grow to fit their content, so the page grew instead. Adding min-w-0 at each level of that chain (app layout, instrument page, loading skeleton, table-pending wrapper, runs-table shell) lets the main pane shrink beside the sidebar.

Comment counts. Runs with comments gave no hint of that in any list. They now show a small grey speech-bubble icon and a count next to the run ID. The runs list query returns comment_count per run from its own query, which runs alongside the attributions query so the file counts on each row are unaffected. Deleted comments are not counted. A new RunIdCell holds the status icon, run ID, and count, and all eight tables (seven instrument variants plus the dashboard) use it. Runs with no comments look unchanged. The field is also in the REST RunListItem schema and the MCP search_runs output.

Checkbox padding. Removed the shadcn [&:has([role=checkbox])]:pr-0 rule so the checkbox column has 6px on both sides instead of 6px and 0.

Things a reviewer might want to know

• Both migrations have to run before this deploys. Until 0043 is applied, Better Auth 1.7 cannot find any account row, so email and Google sign-in both fail on that environment. Until 0044 is applied, MCP OAuth registration fails.
• MCP clients now have to register as native. 1.7 turns away a loopback redirect URI unless the client sends application_type: "native", and there is no server-side setting to relax that. Point a real client at a preview before this reaches production.
• comment_count is a new field on an existing response. Anything parsing RunListItem or search_runs with a strict schema will see the extra key.
• DPoP is still not supported. verifyBearerToken rejects DPoP-bound tokens. Supporting them needs replay storage in the database, so it is left out.

Test plan

• make check passes, including the previously failing type check
• npm run test:unit (360 pass)
• make fe-test-integration (391 pass), covering the MCP OAuth flow end to end and the new comment_count assertions
• Sign in locally with email after applying the migrations
• Gel Doc and SpectraMax run pages scroll inside their card, with no page-level horizontal scroll
• Runs with comments show the icon and count; runs without show nothing extra
• Apply the migrations on staging and confirm Google sign-in still works there
• Register a real MCP client (Cursor, Claude Code) against a preview to confirm the application_type rule

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
data-hub	Ready	Preview	Sep 1, 2026 9:06pm UTC