Skip to main content
← Back to list
01Issue
BugOpenSwamp ClubPublic
AssigneesNone

Relationships

#1820 SSO user profile fields are frozen at first login — overrideUserInfo is never set on any provider

Opened by keeb · 8/25/2026

Problem

SSO user profile fields (name, email, image) are captured at first login and never updated afterward. If a user changes their name or email in the IdP, swamp-club keeps showing the original values indefinitely.

Cause

better-auth gates the only update path for an existing SSO user behind the per-provider overrideUserInfo flag (better-auth src/oauth2/link-account.ts:140):

if (overrideUserInfo) {
  const { id: _, ...restUserInfo } = userInfo;
  // update user info from the provider if overrideUserInfo is true
  user = await c.context.internalAdapter.updateUser(dbUser.user.id, {
    ...restUserInfo,
    email: userInfo.email.toLowerCase(),
    ...
  });
}

The SSO plugin passes this through from the stored provider config (@better-auth/sso dist/index.mjs:2246 — overrideUserInfo: config.overrideUserInfo).

rg overrideUserInfo lib/ routes/ models/ in swamp-club returns nothing. It is never set on any ssoProvider record, so it is falsy for every provider.

Consequence

provisionUserOnEveryLogin: true gives the impression that user data is resynced on each login, but the swamp-club hook only writes idpGroups and emailVerified (lib/auth.ts:1040). Everything else better-auth would normally refresh is skipped because overrideUserInfo is unset.

Net effect: name, email, and image are frozen at first login, permanently, for all SSO users.

The email case is the one with downstream reach — provisionSsoMembership (lib/app/provision-sso-member.ts:47) resolves the collective by email domain, so a stale email means membership decisions are made against an address the IdP no longer considers current.

Suggested fix

Set overrideUserInfo on SSO provider records, either as a default for newly registered providers or as an admin-visible setting. Worth confirming the intended behavior for emailVerified on email change first — better-auth resets it when the address differs from the stored one.

Filed separately from the group-staleness issue because they are independent: this one is about profile fields and is a much smaller fix.

02Bog Flow
◉OPEN○TRIAGED○IN PROGRESS○SHIPPED

Open

8/25/2026, 2:33:51 PM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

keeb commented 8/25/2026, 2:34:17 PM

The group-staleness issue referenced in the last paragraph is #1819. SCIM provisioning is #1821.

Sign in to post a ripple.