Reopening: upstream blockers resolved, tentative v3 direction

Reopening this PR with updated context. @ivoilic — apologies for the long delay. Since this PR was closed on April 1, we've taken another look at the Better Auth + Cloudflare Workers landscape, and the picture has materially changed. The blockers cited at close time were actually already fixed when we wrote that comment.

Upstream blocker status (re-checked)

In short: all four cited showstoppers were closed months before we cited them. That's on us — the closing comment should have held up better against re-verification.

Currently open Workers-adjacent issues

• #7657 — Cross-origin auth regression in 1.4.x with Hono + CF Workers + Next.js proxy. Only affects setups where API and web app are on different domains with proxy rewrites. SonicJS serves admin + API from the same Worker, so this shouldn't bite us.
• #8655 — Drizzle adapter double-stringify on SQLite. Real bug to watch since we're D1 + Drizzle. Needs verification on JSON-typed field round-tripping before commit.
• #7440 — additionalFields: string[] returns stringified array. Adapter marshaling quirk, workaroundable.

No open Workers- or D1-blocking issues beyond these. The zpg6/better-auth-cloudflare shim (534⭐, last release v0.3.0 on April 5, 2026, active maintenance) handles per-request instance lifecycle, D1, Hyperdrive, KV, R2, and migrations. That covers the singleton/WAL-lock concerns from our earlier research note.

Better Auth itself is on v1.6.11 (May 12, 2026) with v1.7 in beta — shipping roughly weekly.

Why we're reconsidering: BetterAuth vs current SonicJS auth

Issues like #803 (custom profile fields stripped from /auth/me), #783 (role-based UI gating not enforced), and #382 (no SAML/SSO) are all symptoms of the same root cause: our current auth is role-name string checks ('admin' | 'editor' | 'author' | 'viewer') with no permission abstraction, no MFA, no SSO, no session revocation, no client SDK. Building all of that ourselves competes for time with CMS work.

Feature matrix

Core auth

Social / Enterprise SSO

MFA

Authorization / RBAC

Multi-tenancy

API & tokens

Admin

DX

Compliance

Tentative plan: target v3.0

We're going to tentatively plan a Better Auth migration as part of v3.0. The reasoning:

1. The upstream CF Workers blockers are gone.
2. The better-auth-cloudflare shim handles the remaining Workers/D1 lifecycle nuances.
3. Migrating would close a cluster of currently-open issues in one shot (User scope is not working as expected #783 , /auth/me and /auth/otp/verify omit custom user profile fields (plan, etc.) #803 , Enterprise SSO (SAML/OIDC) #382 , Feature: Add JavaScript/TypeScript Client SDK for Frontend Frameworks #585 , parts of GDPR compliance implementation #383 /SOC 2 compliance preparation #384 , the OAuth plugin work in Feature: OAuth/Social Login Providers Plugin #737 becomes free).
4. We avoid building real RBAC, MFA, organizations, and a client SDK ourselves — those are months of work each.
5. v3 is the right release vehicle since this is a breaking change.

Open questions we'll work through before merging:

• Password rehash strategy. Existing users have PBKDF2 hashes (post v2.8.3 hardening). Plan: keep the old hash column, verify against it on next login, and re-hash via Better Auth on successful auth. No mass-rehash needed, no forced password resets.
• Custom profile fields. Map defineUserProfile() to Better Auth's additionalFields config — this is the same primitive, so it should be a clean translation that also fixes /auth/me and /auth/otp/verify omit custom user profile fields (plan, etc.) #803 .
• Role translation. Map 'admin' | 'editor' | 'author' | 'viewer' to Better Auth roles using createAccessControl() with explicit resource ×ばつ verb statements. Document the verbs as part of the v3 migration guide. This also gives us a path forward on User scope is not working as expected #783 .
• Session model shift. Moving from stateless JWT to DB-backed sessions changes the deployment story (every request now hits D1 for session lookup). Need to benchmark this on a realistic worker and decide if we want to layer a KV cache in front.
• E2E coverage. This was rightly flagged at close. Will be a blocker for merge.
• Pin a minor version. Better Auth has been willing to break things across minors (the 1.4.x cross-origin regression cluster). We'll pin a known-good version and upgrade deliberately.
• Rebase on hardened main. All the v2.8.3+ security work (PBKDF2, CSRF, rate limiting, RBAC enforcement scaffolding) needs to merge through cleanly.

@ivoilic — would love your collaboration

Your original PR remains the right architectural direction. If you have bandwidth and interest in picking this back up against current main, we'd love to work with you on it as the foundation for v3. If not, totally understand — we'll reference your work as we plan internally either way. 🙏

Marking this as a v3 milestone target. Will leave the PR open while we scope and align.