OpenSaasAU · borisno2 · Jul 24, 2026 · Jul 24, 2026
diff --git a/.changeset/auth-forms-server-actions.md b/.changeset/auth-forms-server-actions.md
diff --git a/packages/auth/CHANGELOG.md b/packages/auth/CHANGELOG.md
@@ -1,5 +1,57 @@
 # @opensaas/stack-auth
 
+## 0.32.0
+
+### Minor Changes
+
+- [#813](https://github.com/OpenSaasAU/stack/pull/813) [`5a6198c`](https://github.com/OpenSaasAU/stack/commit/5a6198c9489641e4b1ad542a3181c15e750f7d85) Thanks [@borisno2](https://github.com/borisno2)! - Auth forms now submit through app-owned server actions instead of the browser `authClient`
+
+  The pre-built auth forms (`SignInForm`, `SignUpForm`, `ForgotPasswordForm`, and the new
+  `ResetPasswordForm`) no longer take an `authClient` prop that calls `/api/auth/*` from the
+  browser. Instead each form takes **server action** props — `'use server'` functions the app
+  defines against its own `auth` instance. This keeps the auth network surface server-side and
+  matches the app's existing `lib/actions/*` convention. `createAuth` now auto-adds
+  better-auth's `nextCookies` plugin, so the session cookie set inside a server action persists.
+  See ADR-0020.
+
+  The package exports the action contract types (`AuthActionResult`, `SignInInput`,
+  `SignUpInput`, `RequestPasswordResetInput`, `ResetPasswordInput`, and the action aliases).
+  `createClient` is unchanged for client-side session reading (`useSession`).
+
+  Migration — define the actions in your app and pass them to the forms:
+
+  ```typescript
+  // lib/actions/auth.ts
+  'use server'
+  import { headers } from 'next/headers'
+  import { auth } from '@/lib/auth'
+  import type { AuthActionResult, SignInInput } from '@opensaas/stack-auth/ui'
+
+  export async function signInAction(input: SignInInput): Promise<AuthActionResult> {
+    try {
+      await auth.api.signInEmail({
+        body: { email: input.email, password: input.password },
+        headers: await headers(),
+      })
+      return { success: true }
+    } catch (err) {
+      return { success: false, error: err instanceof Error ? err.message : 'Sign in failed' }
+    }
+  }
+  ```
+
+  ```tsx
+  // Before
+  <SignInForm authClient={authClient} redirectTo="/admin" />
+
+  // After
+  <SignInForm signInAction={signInAction} redirectTo="/admin" />
+  ```
+
+  Social sign-in becomes a redirecting server action passed as `signInSocialAction`. The CLI
+  feature-generator now scaffolds `lib/actions/auth.ts` and a `reset-password` page, and no
+  longer emits `lib/auth-client.ts`.
+
 ## 0.31.1
 
 ## 0.31.0

diff --git a/packages/auth/package.json b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-auth",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "Better-auth integration for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",

diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,62 @@
 # @opensaas/stack-cli
 
+## 0.32.0
+
+### Minor Changes
+
+- [#813](https://github.com/OpenSaasAU/stack/pull/813) [`5a6198c`](https://github.com/OpenSaasAU/stack/commit/5a6198c9489641e4b1ad542a3181c15e750f7d85) Thanks [@borisno2](https://github.com/borisno2)! - Auth forms now submit through app-owned server actions instead of the browser `authClient`
+
+  The pre-built auth forms (`SignInForm`, `SignUpForm`, `ForgotPasswordForm`, and the new
+  `ResetPasswordForm`) no longer take an `authClient` prop that calls `/api/auth/*` from the
+  browser. Instead each form takes **server action** props — `'use server'` functions the app
+  defines against its own `auth` instance. This keeps the auth network surface server-side and
+  matches the app's existing `lib/actions/*` convention. `createAuth` now auto-adds
+  better-auth's `nextCookies` plugin, so the session cookie set inside a server action persists.
+  See ADR-0020.
+
+  The package exports the action contract types (`AuthActionResult`, `SignInInput`,
+  `SignUpInput`, `RequestPasswordResetInput`, `ResetPasswordInput`, and the action aliases).
+  `createClient` is unchanged for client-side session reading (`useSession`).
+
+  Migration — define the actions in your app and pass them to the forms:
+
+  ```typescript
+  // lib/actions/auth.ts
+  'use server'
+  import { headers } from 'next/headers'
+  import { auth } from '@/lib/auth'
+  import type { AuthActionResult, SignInInput } from '@opensaas/stack-auth/ui'
+
+  export async function signInAction(input: SignInInput): Promise<AuthActionResult> {
+    try {
+      await auth.api.signInEmail({
+        body: { email: input.email, password: input.password },
+        headers: await headers(),
+      })
+      return { success: true }
+    } catch (err) {
+      return { success: false, error: err instanceof Error ? err.message : 'Sign in failed' }
+    }
+  }
+  ```
+
+  ```tsx
+  // Before
+  <SignInForm authClient={authClient} redirectTo="/admin" />
+
+  // After
+  <SignInForm signInAction={signInAction} redirectTo="/admin" />
+  ```
+
+  Social sign-in becomes a redirecting server action passed as `signInSocialAction`. The CLI
+  feature-generator now scaffolds `lib/actions/auth.ts` and a `reset-password` page, and no
+  longer emits `lib/auth-client.ts`.
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @opensaas/stack-core@0.32.0
+
 ## 0.31.1
 
 ### Patch Changes

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-cli",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "CLI tools for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",

diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @opensaas/stack-core
 
+## 0.32.0
+
 ## 0.31.1
 
 ## 0.31.0

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-core",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "Core stack for OpenSaas - schema definition, access control, and runtime utilities",
   "type": "module",
   "main": "./dist/index.js",

diff --git a/packages/rag/CHANGELOG.md b/packages/rag/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @opensaas/stack-rag
 
+## 0.32.0
+
 ## 0.31.1
 
 ## 0.31.0

diff --git a/packages/rag/package.json b/packages/rag/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-rag",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "RAG and AI embeddings integration for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",

diff --git a/packages/storage-s3/CHANGELOG.md b/packages/storage-s3/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @opensaas/stack-storage-s3
 
+## 0.32.0
+
 ## 0.31.1
 
 ## 0.31.0

diff --git a/packages/storage-s3/package.json b/packages/storage-s3/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-storage-s3",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "AWS S3 storage provider for OpenSaas Stack file uploads",
   "type": "module",
   "exports": {

diff --git a/packages/storage-vercel/CHANGELOG.md b/packages/storage-vercel/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @opensaas/stack-storage-vercel
 
+## 0.32.0
+
 ## 0.31.1
 
 ## 0.31.0

diff --git a/packages/storage-vercel/package.json b/packages/storage-vercel/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-storage-vercel",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "Vercel Blob storage provider for OpenSaas Stack file uploads",
   "type": "module",
   "exports": {

diff --git a/packages/storage/CHANGELOG.md b/packages/storage/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @opensaas/stack-storage
 
+## 0.32.0
+
 ## 0.31.1
 
 ## 0.31.0

diff --git a/packages/storage/package.json b/packages/storage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-storage",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "File and image upload field types with pluggable storage providers for OpenSaas Stack",
   "type": "module",
   "exports": {

diff --git a/packages/tiptap/CHANGELOG.md b/packages/tiptap/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @opensaas/stack-tiptap
 
+## 0.32.0
+
 ## 0.31.1
 
 ## 0.31.0

diff --git a/packages/tiptap/package.json b/packages/tiptap/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-tiptap",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "Tiptap rich text editor integration for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",

diff --git a/packages/ui/CHANGELOG.md b/packages/ui/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @opensaas/stack-ui
 
+## 0.32.0
+
 ## 0.31.1
 
 ### Patch Changes

diff --git a/packages/ui/package.json b/packages/ui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-ui",
-  "version": "0.31.1",
+  "version": "0.32.0",
   "description": "Composable React UI components for OpenSaas Stack",
   "type": "module",
   "main": "./dist/index.js",