[waleedlatif1]

Summary

• Reconnecting a credential and picking a provider account that already backs another credential in the same workspace ended on a raw 500: Better Auth runs account.create.after once the callback has already answered, so the draft-hook guard's throw escaped the whole handler
• The conflict is now decided in account.create.before, before the account row exists: the reconnect draft is discarded and the callback redirects back to the page the reconnect started from with error=credential_account_conflict and a reason. Nothing is written, so the reconnected credential keeps its original account and the other credential keeps its own row and tokens
• The reason names the provider and the credential already using the account ("That Google account is already connected in this workspace as "Personal Drive". Use that connection, or reconnect with the account that belongs to this one."), shown through the existing OAuth return toast. Only this server-issued code surfaces its error_description; provider descriptions stay behind the generic message
• The draft-hook guard stays as the last line of defense and now throws a typed CredentialAccountConflictError; the after-hook logs it at warn instead of failing the callback
• Shared the account-id suffix logic (stableExternalAccountId) between the stale-sibling migration and the new check

Type of Change

• Bug fix

Testing

• New oauth-reconnect-account-conflict.integration.ts drives Better Auth's real /oauth2/link → /oauth2/callback/google-drive against Postgres with fixture provider endpoints: a conflicting reconnect redirects back with the reason and leaves both credentials, both account rows, and their tokens untouched; reconnecting with the credential's own identity still rebinds it
• Red→green: fails on the pre-fix hooks (the guard error escapes the handler) and fails with only the after-hook catch kept (callback reports success)
• use-oauth-return.test.ts, draft-hooks.test.ts, draft-processor.test.ts, use-oauth-return-hooks.test.tsx; biome; check:comment-hygiene, check:file-names, check:test-patterns, check:utils, check:import-specifiers, check:unused-exports

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 27, 2026 2:54am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new blocking issues remain.

Summary

Conflicting OAuth reconnects now return users to their starting page with a clear reason instead of a server error.

• OAuth reconnects explain account conflicts without moving either credential.
• OAuth return messages explain which connection already uses the chosen account.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Callback[OAuth callback] --> Check{Reconnect conflicts?}
  Check -->|No| Normal[Continue normal account creation]
  Check -->|Yes| Tokens[Save fresh tokens on existing accounts]
  Tokens --> Recover[Resume connectors stopped by revoked credentials]
  Recover --> Draft[Discard reconnect draft]
  Draft --> Slack[Spread fresh Slack tokens when needed]
  Slack --> Return[Redirect back with conflict reason]
  Return --> Toast[Show reason in existing OAuth toast]

Loading

_{Reviews (3) · Last reviewed commit: "fix(credentials): keep stored scope and ..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 8 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 8 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}