You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Added Ghost-specific Knex adapter tests for Better Auth - #32615
Better Auth's adapter suite already runs on MySQL in the integration lane, but it can't cover behaviour that only exists because of Ghost's schema. This adds test/integration/auth/knex-adapter-ghost.test.ts, which runs against Ghost's real test database:
Virtual email_verified: reads true for every user, filters on the expression, and writes of either value are dropped without error.
Virtual two_factor_enabled:true only with a verified user_two_factors row. No row, or only an unverified one, reads false. Writes are dropped. Fields come from ghostTwoFactorSchema.
createDefaults: a user created through Better Auth gets slug set to its id and password set to !, and @tryghost/security's compare rejects that hash.
Dates:user_sessions, user_accounts and verifications keep their milliseconds through the adapter and in the stored row.
user_two_factors becomes an in-development table in schema.js, so it only exists in development and testing databases and has no migration. That way the test checks two_factor_enabled against the table definition the twoFactor plugin will use, rather than one the test builds for itself. The table holds TOTP secrets and backup codes, so it's added to the exporter's BACKUP_TABLES and stays out of exports by default, like the other auth tables.
For reviewers:
Every existing suite skip still has its cause documented in the README. The virtual columns behave as the issue specifies, so plan §10's fallback (real users columns) isn't needed.
user_two_factors has no unique key on user_id and no index on secret (the plugin marks secret as indexed, but it's a text column).
To check the new tests catch regressions, I broke the virtual columns and the default password locally: 5 of the 11 tests failed.
Run locally on MySQL 8, all passing: the auth integration tests (482 passed, the suite's usual 15 skips), the exporter and migration integration tests, and the schema and exporter unit tests.
ref https://linear.app/ghost/issue/PLA-597/get-the-knex-adapter-suite-green-on-mysql-in-ci
Better Auth's adapter suite can't cover the parts of the adapter that only
exist because of Ghost's schema: the virtual email_verified and
two_factor_enabled columns, the users create defaults, and millisecond dates
on the new tables. These tests pin that behaviour against Ghost's real test
database, so the virtual columns are proven before plan §10 open decision 1
is settled.
user_two_factors becomes an in-development table rather than something the
test builds itself, so two_factor_enabled is tested against the definition
the twoFactor plugin will use. It holds TOTP secrets and backup codes, so it
is left out of exports by default like the other auth tables.
No actionable comments were generated in the recent review.
Walkthrough
The schema adds user_two_factors with a user reference, secret and backup-code fields, verification and failure-count defaults, and a nullable lock timestamp. The table is marked in development and added to the optional backup table list. Exporter tests check its table key and its absence from exported data. A database-backed integration suite tests Ghost-specific adapter behavior, including virtual values, creation defaults, and millisecond date round-tripping.
Possibly related PRs
TryGhost/Ghost#32609: Changes adapter ID generation, which the new adapter tests configure when creating rows.
TryGhost/Ghost#32583: Adds the Knex adapter, virtual columns, and user creation defaults that this PR tests against Ghost's database.
TryGhost/Ghost#32584: Adds in-development auth tables and millisecond date support covered by this PR's date round-trip tests.
Suggested reviewers: allouis
Merge Risk: Minimal · up to c6c04
No actionable issue remains from this review; the change is mergeable after normal checks.
Pre-merge checks: 7
Check name
Status
Explanation
Title check
The title clearly identifies the main change: Ghost-specific Knex adapter tests for Better Auth.
Description check
The description covers the adapter tests, the in-development table, and the exporter change.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Type-Safe Boundaries
The production TypeScript change adds a table name to a list. It adds no boundary-data consumption or typing bypass. The other code changes are in tests or existing JavaScript files, which this check …
New Files Are Typescript
The PR adds one TypeScript test file. It adds no JavaScript files. The JavaScript files in the diff already exist.
Tooling Ownership
The PR changes Core schema and exporter code, documentation, and integration tests. The new adapter test is beside the existing auth integration tests. No tooling entrypoints, scripts, or shared confi…
Full details: Type-Safe Boundaries
Explanation
The production TypeScript change adds a table name to a list. It adds no boundary-data consumption or typing bypass. The other code changes are in tests or existing JavaScript files, which this check excludes.
Full details: Tooling Ownership
Explanation
The PR changes Core schema and exporter code, documentation, and integration tests. The new adapter test is beside the existing auth integration tests. No tooling entrypoints, scripts, or shared configurations move or change.
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.
New source files must be TypeScript: flag new JS files as a required change unless exempt (DB migrations, tool/config files, tools/scripts/, docker/, generated code).
CodeRabbit configuration file
Files:
ghost/test/integration/exporter/exporter.test.js
ghost/core/server/data/schema/schema.js
ghost/core/server/data/exporter/table-lists.js
Review lens: "where does this data become trusted?" Boundary data (HTTP input, external API/SDK responses, env/config, DB/filesystem reads, queue/webhook/event payloads) is `unknown` until validated — Zod by default.
Applicability reference: AGENTS.md: # AGENTS.md Start with: [Testing](docs/contributing/testing.md) Source excerpt: Put tests as close as possible to the code and behavior under test: **Unit tests** cover a function, compo...
Learnt from: CR
Repo: TryGhost/Ghost
Timestamp: 2026-11-06T00:06:59.901Z
Learning: Applicability reference:
AGENTS.md: # AGENTS.md
Start with:
- [Contribution workflow](docs/contributing/workflow.md)
Source excerpt:
# Contribution workflow
## Formatting
Source formatting is owned by [Oxfmt](https://oxc.rs/docs/guide/usage/formatter),
configured in the root `.oxfmtrc.json`: Oxfmt defaults plus single quotes, with
embedded-language formatting disabled so string contents are never rewritten.
CI rejects unformatted code, and the pre-commit hook formats staged files
automatically, so there is usually nothing to do. To format manually:
```bash
pnpm format path/to/file.ts
```
Learnt from: CR
Repo: TryGhost/Ghost
Timestamp: 2026-11-06T00:07:00.011Z
Learning: Applicability reference:
AGENTS.md: # AGENTS.md
Agent-specific execution guidance for the Ghost monorepo. Human-readable setup,
workflow, architecture, and practice guidance lives in the
[codebase documentation](docs/README.md) and nearby package READMEs.
Source excerpt:
# Ghost Codebase Documentation
## Guides
### Testing
Use `pnpm check` as the default one-stop command for formatting checks, linting,
and testing. Add tests at the closest layer to the behavior you changed. Browser
end-to-end tests run separately from `pnpm check`.
Learnt from: CR
Repo: TryGhost/Ghost
Timestamp: 2026-11-06T00:06:59.901Z
Learning: Applicability reference:
AGENTS.md: # AGENTS.md
Start with:
- [Contribution workflow](docs/contributing/workflow.md)
Source excerpt:
# Contribution workflow
## Make and validate the change
Add or update automated tests when behavior changes. Run the most focused checks
for the code you touched, following the README beside that workspace. Before
handing off a change, use the repository's one-stop formatting, lint, and test
command:
```bash
pnpm check
```
Ensure the fix-ci command is configured to always run in your CI pipeline to get automatic fixes in future runs. For more information, please see https://nx.dev/ci/features/self-healing-ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
migration[pull request] Includes migration for review
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
the
migration
ref https://linear.app/ghost/issue/PLA-597/get-the-knex-adapter-suite-green-on-mysql-in-ci
Better Auth's adapter suite already runs on MySQL in the integration lane, but it can't cover behaviour that only exists because of Ghost's schema. This adds
test/integration/auth/knex-adapter-ghost.test.ts, which runs against Ghost's real test database:email_verified: readstruefor every user, filters on the expression, and writes of either value are dropped without error.two_factor_enabled:trueonly with a verifieduser_two_factorsrow. No row, or only an unverified one, readsfalse. Writes are dropped. Fields come fromghostTwoFactorSchema.createDefaults: a user created through Better Auth getsslugset to its id andpasswordset to!, and@tryghost/security's compare rejects that hash.user_sessions,user_accountsandverificationskeep their milliseconds through the adapter and in the stored row.user_two_factorsbecomes an in-development table inschema.js, so it only exists in development and testing databases and has no migration. That way the test checkstwo_factor_enabledagainst the table definition thetwoFactorplugin will use, rather than one the test builds for itself. The table holds TOTP secrets and backup codes, so it's added to the exporter'sBACKUP_TABLESand stays out of exports by default, like the other auth tables.For reviewers:
userscolumns) isn't needed.user_two_factorshas no unique key onuser_idand no index onsecret(the plugin markssecretas indexed, but it's a text column).Run locally on MySQL 8, all passing: the auth integration tests (482 passed, the suite's usual 15 skips), the exporter and migration integration tests, and the schema and exporter unit tests.
🤖 Generated with Claude Code