test(open-api): lock in requestBody for /phone-number/verify - #11208

Closes #8122

Summary

/phone-number/verify dropped its OpenAPI requestBody after v1.4.19. The body schema is z.object({…}).and(z.record(z.string(), z.any())) so additional user fields can pass through signUpOnVerification. The generator had no ZodIntersection handler, so instanceof ZodObject was false and the body was omitted from the spec.

Runtime was never broken. Generated clients were: swift-openapi-generator produced a verify function with no parameters.

On current main (1.7.3) the generator already flattens object+record intersections. /sign-in/email-otp uses the same .and(z.record()) pattern and already has coverage. This PR does not retouch the generator. It adds the reported phone-number endpoint as a regression so #8122 cannot silently come back.

Problem (from #8122)

Repro from the issue, still the schema on main:

const verifyPhoneNumberBodySchema = z
  .object({
    phoneNumber: z.string(),
    code: z.string(),
    disableSession: z.boolean().optional(),
    updatePhoneNumber: z.boolean().optional(),
  })
  .and(z.record(z.string(), z.any()));

Expected: POST /phone-number/verify emits requestBody with required phoneNumber and code.
v1.4.19 / v1.6.26: requestBody missing. /phone-number/send-otp stayed intact because it is a plain z.object.

Confirmed on v1.6.26 (6 Aug). Previous attempt: #9472 (same root cause, closed unmerged 13 May, no review). @pupuking723 claimed it verbally on 23 Aug with no PR since.

What this PR adds

packages/better-auth/src/plugins/open-api/open-api.test.ts only.

1. Boot openAPI() + phoneNumber({ sendOTP, signUpOnVerification }) — same options as the original repro.
2. Assert every phone-number POST path has a requestBody:
   • /sign-in/phone-number
   • /phone-number/send-otp
   • /phone-number/verify
   • /phone-number/request-password-reset
   • /phone-number/reset-password
3. Focused phone-number plugin: OpenAPI spec missing requestBody for /phone-number/verify in v1.4.19 #8122 case on /phone-number/verify:
   • requestBody.required === true
   • type: "object"
   • required: phoneNumber, code
   • optional: disableSession, updatePhoneNumber (boolean, not in required)
   • additionalProperties: {} — the .and(z.record(z.string(), z.any())) extra-keys contract, matching the existing email-otp assertion

No production code. No changeset.

Verification

pnpm vitest packages/better-auth/src/plugins/open-api/open-api.test.ts --run

32 passed, including the two new phone-number cases. Biome + cspell clean on the commit.

Related

• phone-number plugin: OpenAPI spec missing requestBody for /phone-number/verify in v1.4.19 #8122 — missing /phone-number/verify requestBody (this PR)
• fix(open-api): emit requestBody for ZodIntersection body schemas #9472 — earlier generator patch, closed unmerged
• Existing coverage for the same Zod pattern: /sign-in/email-otp in this file (should merge object and record intersections for email OTP sign-in request bodies)

Agent disclosure

Written by an AI agent on behalf of @devtechedge, who has reviewed this pull request.

Summary by cubic

Adds regression tests for the OpenAPI requestBody on phone-number POST endpoints, locking in the /phone-number/verify body that was missing from generated specs since v1.4.19. The bug came from the generator not handling ZodIntersection, but runtime was never affected. No production code changes; the tests assert required fields, optional fields, and the additionalProperties contract, closing #8122.

^{Written for commit 5e44d9f. Summary will update on new commits.}