fix(router): run rate limiting before request routing

[salasebas]

Summary

• move disabled-path rejection and central rate limiting ahead of plugin request hooks and router resolution
• keep rate-limit buckets keyed to the original request when a plugin replaces the request before routing
• add observable atomic secondary-storage coverage for quota, unknown, invalid method/media, middleware, server-only, disabled, and request-rewrite paths

Upstream parity

Compared only against Better Auth v1.6.23 at commit 9dfceee14021fc15a2fb93023f39635f25b0b5ba.

Verification

• router test: 44 runs, 218 assertions, 0 failures
• plugin contract test: 5 runs, 27 assertions, 0 failures
• full core suite: 1545 runs, 9444 assertions, 0 failures
• package-wide StandardRB
• fresh blind diff-only review: Approve

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
better-auth	Ignored		Aug 20, 2026 10:17pm