From 6ebc0f470032944903d522592cd7131bb5b8de30 Mon Sep 17 00:00:00 2001
From: Johannes Fleck <johannes.fleck@stackable.tech>
Date: Thu, 24 Sep 2026 11:02:18 +0200
Subject: [PATCH] fix(auth): prevent users from gaining additional permissions

---
 src/lib/server/auth.test.ts | 21 +++++++++++++++++++++
 src/lib/server/auth.ts      |  3 ++-
 2 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 src/lib/server/auth.test.ts

diff --git a/src/lib/server/auth.test.ts b/src/lib/server/auth.test.ts
new file mode 100644
index 00000000..ac7901f4
--- /dev/null
+++ b/src/lib/server/auth.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import { parseUserInput } from 'better-auth/db';
+import { auth } from './auth.js';
+
+describe('user.additionalFields.username', () => {
+  it('rejects a rewrite through the built-in update-user endpoint', () => {
+    expect(() => parseUserInput(auth.options, { username: 'someone-else' }, 'update')).toThrow(
+      /username is not allowed to be set/
+    );
+  });
+
+  it('rejects a rewrite smuggled in at sign-up', () => {
+    expect(() => parseUserInput(auth.options, { username: 'someone-else' }, 'create')).toThrow(
+      /username is not allowed to be set/
+    );
+  });
+
+  it('is still declared, so the OIDC claim can populate it', () => {
+    expect(auth.options.user?.additionalFields?.username).toMatchObject({ type: 'string' });
+  });
+});
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index 2972e467..ae1967a6 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -40,7 +40,8 @@ export const auth = betterAuth({
     additionalFields: {
       username: {
         type: 'string',
-        required: false
+        required: false,
+        input: false
       }
     }
   },