@better-auth/core 1.4.11-beta.2 → 1.4.11

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @better-auth/core@1.4.11-beta.2 build /home/runner/work/better-auth/better-auth/packages/core
+> @better-auth/core@1.4.11 build /home/runner/work/better-auth/better-auth/packages/core
 > tsdown
 
 ℹ tsdown v0.17.2 powered by rolldown v1.0.0-beta.53
@@ -37,7 +37,7 @@
 ℹ dist/api/index.d.mts                 0.26 kB │ gzip:  0.14 kB
 ℹ dist/async_hooks/index.d.mts         0.24 kB │ gzip:  0.16 kB
 ℹ dist/async_hooks/pure.index.d.mts    0.22 kB │ gzip:  0.16 kB
-ℹ dist/index-eRGNbXt_.d.mts          227.31 kB │ gzip: 35.80 kB
+ℹ dist/index-BHaoMSKV.d.mts          227.72 kB │ gzip: 35.92 kB
 ℹ dist/index-BRBu0-5h.d.mts            3.31 kB │ gzip:  1.11 kB
-ℹ 32 files, total: 410.48 kB
-✔ Build complete in 5228ms
+ℹ 32 files, total: 410.89 kB
+✔ Build complete in 5410ms

package/dist/api/index.d.mts

@@ -1,2 +1,2 @@
-import { a as optionsMiddleware, i as createAuthMiddleware, n as AuthMiddleware, r as createAuthEndpoint, t as AuthEndpoint } from "../index-eRGNbXt_.mjs";
+import { a as optionsMiddleware, i as createAuthMiddleware, n as AuthMiddleware, r as createAuthEndpoint, t as AuthEndpoint } from "../index-BHaoMSKV.mjs";
 export { AuthEndpoint, AuthMiddleware, createAuthEndpoint, createAuthMiddleware, optionsMiddleware };

package/dist/context/index.d.mts

@@ -1,4 +1,4 @@
-import { Xn as DBAdapter, f as AuthContext, tr as DBTransactionAdapter } from "../index-eRGNbXt_.mjs";
+import { Xn as DBAdapter, f as AuthContext, tr as DBTransactionAdapter } from "../index-BHaoMSKV.mjs";
 import { AsyncLocalStorage } from "@better-auth/core/async_hooks";
 import { EndpointContext, InputContext } from "better-call";
 

package/dist/db/adapter/index.d.mts

@@ -1,2 +1,2 @@
-import { $n as DBAdapterInstance, Cr as initGetIdField, Dr as initGetDefaultFieldName, Er as initGetDefaultModelName, Jn as CleanedWhere, Qn as DBAdapterFactoryConfig, Sr as initGetModelName, Tr as initGetFieldAttributes, Xn as DBAdapter, Yn as CustomAdapter, Zn as DBAdapterDebugLogOption, ar as deepmerge, cr as createAdapter, dr as AdapterFactoryConfig, er as DBAdapterSchemaCreation, fr as AdapterFactoryCustomizeAdapterCreator, gr as CreateCustomAdapter, hr as CreateAdapterOptions, ir as Where, lr as createAdapterFactory, mr as AdapterTestDebugLogs, nr as JoinConfig, or as withApplyDefault, pr as AdapterFactoryOptions, rr as JoinOption, sr as AdapterFactory, tr as DBTransactionAdapter, ur as AdapterConfig, wr as initGetFieldName } from "../../index-eRGNbXt_.mjs";
+import { $n as DBAdapterInstance, Cr as initGetIdField, Dr as initGetDefaultFieldName, Er as initGetDefaultModelName, Jn as CleanedWhere, Qn as DBAdapterFactoryConfig, Sr as initGetModelName, Tr as initGetFieldAttributes, Xn as DBAdapter, Yn as CustomAdapter, Zn as DBAdapterDebugLogOption, ar as deepmerge, cr as createAdapter, dr as AdapterFactoryConfig, er as DBAdapterSchemaCreation, fr as AdapterFactoryCustomizeAdapterCreator, gr as CreateCustomAdapter, hr as CreateAdapterOptions, ir as Where, lr as createAdapterFactory, mr as AdapterTestDebugLogs, nr as JoinConfig, or as withApplyDefault, pr as AdapterFactoryOptions, rr as JoinOption, sr as AdapterFactory, tr as DBTransactionAdapter, ur as AdapterConfig, wr as initGetFieldName } from "../../index-BHaoMSKV.mjs";
 export { AdapterConfig, AdapterFactory, AdapterFactoryConfig, AdapterFactoryCustomizeAdapterCreator, AdapterFactoryOptions, AdapterTestDebugLogs, CleanedWhere, CreateAdapterOptions, CreateCustomAdapter, CustomAdapter, DBAdapter, DBAdapterDebugLogOption, DBAdapterFactoryConfig, DBAdapterInstance, DBAdapterSchemaCreation, DBTransactionAdapter, JoinConfig, JoinOption, Where, createAdapter, createAdapterFactory, deepmerge, initGetDefaultFieldName, initGetDefaultModelName, initGetFieldAttributes, initGetFieldName, initGetIdField, initGetModelName, withApplyDefault };

package/dist/db/index.d.mts

@@ -1,2 +1,2 @@
-import { Ar as User, Br as getAuthTables, Fr as RateLimit, Gr as DBFieldType, Hr as BetterAuthDBSchema, Ir as rateLimitSchema, Jr as SecondaryStorage, Kr as DBPrimitive, Lr as Account, Mr as coreSchema, Nr as Session, Or as Verification, Pr as sessionSchema, Rr as accountSchema, Ur as DBFieldAttribute, Vr as BaseModelNames, Wr as DBFieldAttributeConfig, jr as userSchema, kr as verificationSchema, qr as ModelNames, zr as BetterAuthPluginDBSchema } from "../index-eRGNbXt_.mjs";
+import { Ar as User, Br as getAuthTables, Fr as RateLimit, Gr as DBFieldType, Hr as BetterAuthDBSchema, Ir as rateLimitSchema, Jr as SecondaryStorage, Kr as DBPrimitive, Lr as Account, Mr as coreSchema, Nr as Session, Or as Verification, Pr as sessionSchema, Rr as accountSchema, Ur as DBFieldAttribute, Vr as BaseModelNames, Wr as DBFieldAttributeConfig, jr as userSchema, kr as verificationSchema, qr as ModelNames, zr as BetterAuthPluginDBSchema } from "../index-BHaoMSKV.mjs";
 export { Account, BaseModelNames, BetterAuthDBSchema, BetterAuthPluginDBSchema, DBFieldAttribute, DBFieldAttributeConfig, DBFieldType, DBPrimitive, ModelNames, RateLimit, SecondaryStorage, Session, User, Verification, accountSchema, coreSchema, getAuthTables, rateLimitSchema, sessionSchema, userSchema, verificationSchema };

package/dist/{index-eRGNbXt_.d.mts → index-BHaoMSKV.d.mts}

@@ -6412,17 +6412,32 @@ type BetterAuthAdvancedOptions = {
    */
   useSecureCookies?: boolean | undefined;
   /**
-   * Disable trusted origins check
+   * Disable all CSRF protection.
+   *
+   * When enabled, this disables:
+   * - Origin header validation when cookies are present
+   * - Fetch Metadata checks (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest)
+   * - Cross-site navigation blocking for first-login scenarios
    *
    * ⚠︎ This is a security risk and it may expose your application to
    * CSRF attacks
+   *
+   * @default false
    */
   disableCSRFCheck?: boolean | undefined;
   /**
-   * Disable origin check
+   * Disable URL validation against trustedOrigins.
    *
-   * ⚠︎ This may allow requests from any origin to be processed by
-   * Better Auth. And could lead to security vulnerabilities.
+   * When enabled, this disables validation of:
+   * - callbackURL
+   * - redirectTo
+   * - errorCallbackURL
+   * - newUserCallbackURL
+   *
+   * ⚠︎ This may allow open redirects and could lead to security
+   * vulnerabilities.
+   *
+   * @default false
    */
   disableOriginCheck?: boolean | undefined;
   /**

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { An as BetterAuthCookies, _ as BetterAuthOptions, _r as Awaitable, b as BetterAuthPlugin, br as Prettify, c as BetterAuthClientPlugin, d as ClientStore, f as AuthContext, g as BetterAuthAdvancedOptions, h as PluginContext, l as ClientAtomListener, m as InternalAdapter, o as StandardSchemaV1, p as GenericEndpointContext, s as BetterAuthClientOptions, u as ClientFetchOption, v as BetterAuthRateLimitOptions, vr as LiteralString, x as HookEndpointContext, xr as Primitive, y as GenerateIdFn, yr as LiteralUnion } from "./index-eRGNbXt_.mjs";
+import { An as BetterAuthCookies, _ as BetterAuthOptions, _r as Awaitable, b as BetterAuthPlugin, br as Prettify, c as BetterAuthClientPlugin, d as ClientStore, f as AuthContext, g as BetterAuthAdvancedOptions, h as PluginContext, l as ClientAtomListener, m as InternalAdapter, o as StandardSchemaV1, p as GenericEndpointContext, s as BetterAuthClientOptions, u as ClientFetchOption, v as BetterAuthRateLimitOptions, vr as LiteralString, x as HookEndpointContext, xr as Primitive, y as GenerateIdFn, yr as LiteralUnion } from "./index-BHaoMSKV.mjs";
 export { AuthContext, Awaitable, BetterAuthAdvancedOptions, BetterAuthClientOptions, BetterAuthClientPlugin, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, ClientAtomListener, ClientFetchOption, ClientStore, GenerateIdFn, GenericEndpointContext, HookEndpointContext, InternalAdapter, LiteralString, LiteralUnion, PluginContext, Prettify, Primitive, StandardSchemaV1 };

package/dist/oauth2/index.d.mts

@@ -1,2 +1,2 @@
-import { Bn as refreshAccessToken, Fn as validateAuthorizationCode, Gn as OAuth2UserInfo, Hn as clientCredentialsToken, In as validateToken, Kn as OAuthProvider, Ln as generateCodeChallenge, Mn as verifyAccessToken, Nn as verifyJwsAccessToken, Pn as createAuthorizationCodeRequest, Rn as getOAuth2Tokens, Un as createClientCredentialsTokenRequest, Vn as createAuthorizationURL, Wn as OAuth2Tokens, jn as getJwks, qn as ProviderOptions, zn as createRefreshAccessTokenRequest } from "../index-eRGNbXt_.mjs";
+import { Bn as refreshAccessToken, Fn as validateAuthorizationCode, Gn as OAuth2UserInfo, Hn as clientCredentialsToken, In as validateToken, Kn as OAuthProvider, Ln as generateCodeChallenge, Mn as verifyAccessToken, Nn as verifyJwsAccessToken, Pn as createAuthorizationCodeRequest, Rn as getOAuth2Tokens, Un as createClientCredentialsTokenRequest, Vn as createAuthorizationURL, Wn as OAuth2Tokens, jn as getJwks, qn as ProviderOptions, zn as createRefreshAccessTokenRequest } from "../index-BHaoMSKV.mjs";
 export { OAuth2Tokens, OAuth2UserInfo, OAuthProvider, ProviderOptions, clientCredentialsToken, createAuthorizationCodeRequest, createAuthorizationURL, createClientCredentialsTokenRequest, createRefreshAccessTokenRequest, generateCodeChallenge, getJwks, getOAuth2Tokens, refreshAccessToken, validateAuthorizationCode, validateToken, verifyAccessToken, verifyJwsAccessToken };

package/dist/social-providers/index.d.mts

@@ -1,2 +1,2 @@
-import { $ as notion, $t as GoogleOptions, A as vercel, At as LinearUser, B as paybin, Bt as twitter, C as SocialProviderList, Cn as AtlassianProfile, Ct as GitlabProfile, D as socialProviders, Dn as AppleProfile, Dt as linkedin, E as socialProviderList, En as AppleOptions, Et as LinkedInProfile, F as PayPalProfile, Ft as DropboxOptions, G as NaverOptions, Gt as SpotifyProfile, H as LineOptions, Ht as TwitchProfile, I as PayPalTokenResponse, It as DropboxProfile, J as KakaoOptions, Jt as SlackProfile, K as NaverProfile, Kt as spotify, L as paypal, Lt as dropbox, M as PolarProfile, Mt as KickOptions, N as polar, Nt as KickProfile, O as VercelOptions, On as apple, Ot as LinearOptions, P as PayPalOptions, Pt as kick, Q as NotionProfile, Qt as huggingface, R as PaybinOptions, Rt as TwitterOption, S as SocialProvider, Sn as AtlassianOptions, St as GitlabOptions, T as SocialProviders, Tn as AppleNonConformUser, Tt as LinkedInOptions, U as LineUserInfo, Ut as twitch, V as LineIdTokenPayload, Vt as TwitchOptions, W as line, Wt as SpotifyOptions, X as kakao, Xt as HuggingFaceOptions, Y as KakaoProfile, Yt as slack, Z as NotionOptions, Zt as HuggingFaceProfile, _n as discord, _t as RedditProfile, an as microsoft, at as ZoomProfile, bn as cognito, bt as TiktokProfile, cn as github, ct as VkProfile, dn as figma, dt as SalesforceProfile, en as GoogleProfile, et as AccountStatus, fn as FacebookOptions, ft as salesforce, gn as DiscordProfile, gt as RedditOptions, hn as DiscordOptions, ht as roblox, in as MicrosoftOptions, it as ZoomOptions, j as PolarOptions, jt as linear, k as VercelProfile, kn as getApplePublicKey, kt as LinearProfile, ln as FigmaOptions, lt as vk, mn as facebook, mt as RobloxProfile, nn as google, nt as PhoneNumber, on as GithubOptions, ot as zoom, pn as FacebookProfile, pt as RobloxOptions, q as naver, qt as SlackOptions, rn as MicrosoftEntraIDProfile, rt as PronounOption, sn as GithubProfile, st as VkOption, tn as getGooglePublicKey, tt as LoginType, un as FigmaProfile, ut as SalesforceOptions, vn as CognitoOptions, vt as reddit, w as SocialProviderListEnum, wn as atlassian, wt as gitlab, xn as getCognitoPublicKey, xt as tiktok, yn as CognitoProfile, yt as TiktokOptions, z as PaybinProfile, zt as TwitterProfile } from "../index-eRGNbXt_.mjs";
+import { $ as notion, $t as GoogleOptions, A as vercel, At as LinearUser, B as paybin, Bt as twitter, C as SocialProviderList, Cn as AtlassianProfile, Ct as GitlabProfile, D as socialProviders, Dn as AppleProfile, Dt as linkedin, E as socialProviderList, En as AppleOptions, Et as LinkedInProfile, F as PayPalProfile, Ft as DropboxOptions, G as NaverOptions, Gt as SpotifyProfile, H as LineOptions, Ht as TwitchProfile, I as PayPalTokenResponse, It as DropboxProfile, J as KakaoOptions, Jt as SlackProfile, K as NaverProfile, Kt as spotify, L as paypal, Lt as dropbox, M as PolarProfile, Mt as KickOptions, N as polar, Nt as KickProfile, O as VercelOptions, On as apple, Ot as LinearOptions, P as PayPalOptions, Pt as kick, Q as NotionProfile, Qt as huggingface, R as PaybinOptions, Rt as TwitterOption, S as SocialProvider, Sn as AtlassianOptions, St as GitlabOptions, T as SocialProviders, Tn as AppleNonConformUser, Tt as LinkedInOptions, U as LineUserInfo, Ut as twitch, V as LineIdTokenPayload, Vt as TwitchOptions, W as line, Wt as SpotifyOptions, X as kakao, Xt as HuggingFaceOptions, Y as KakaoProfile, Yt as slack, Z as NotionOptions, Zt as HuggingFaceProfile, _n as discord, _t as RedditProfile, an as microsoft, at as ZoomProfile, bn as cognito, bt as TiktokProfile, cn as github, ct as VkProfile, dn as figma, dt as SalesforceProfile, en as GoogleProfile, et as AccountStatus, fn as FacebookOptions, ft as salesforce, gn as DiscordProfile, gt as RedditOptions, hn as DiscordOptions, ht as roblox, in as MicrosoftOptions, it as ZoomOptions, j as PolarOptions, jt as linear, k as VercelProfile, kn as getApplePublicKey, kt as LinearProfile, ln as FigmaOptions, lt as vk, mn as facebook, mt as RobloxProfile, nn as google, nt as PhoneNumber, on as GithubOptions, ot as zoom, pn as FacebookProfile, pt as RobloxOptions, q as naver, qt as SlackOptions, rn as MicrosoftEntraIDProfile, rt as PronounOption, sn as GithubProfile, st as VkOption, tn as getGooglePublicKey, tt as LoginType, un as FigmaProfile, ut as SalesforceOptions, vn as CognitoOptions, vt as reddit, w as SocialProviderListEnum, wn as atlassian, wt as gitlab, xn as getCognitoPublicKey, xt as tiktok, yn as CognitoProfile, yt as TiktokOptions, z as PaybinProfile, zt as TwitterProfile } from "../index-BHaoMSKV.mjs";
 export { AccountStatus, AppleNonConformUser, AppleOptions, AppleProfile, AtlassianOptions, AtlassianProfile, CognitoOptions, CognitoProfile, DiscordOptions, DiscordProfile, DropboxOptions, DropboxProfile, FacebookOptions, FacebookProfile, FigmaOptions, FigmaProfile, GithubOptions, GithubProfile, GitlabOptions, GitlabProfile, GoogleOptions, GoogleProfile, HuggingFaceOptions, HuggingFaceProfile, KakaoOptions, KakaoProfile, KickOptions, KickProfile, LineIdTokenPayload, LineOptions, LineUserInfo, LinearOptions, LinearProfile, LinearUser, LinkedInOptions, LinkedInProfile, LoginType, MicrosoftEntraIDProfile, MicrosoftOptions, NaverOptions, NaverProfile, NotionOptions, NotionProfile, PayPalOptions, PayPalProfile, PayPalTokenResponse, PaybinOptions, PaybinProfile, PhoneNumber, PolarOptions, PolarProfile, PronounOption, RedditOptions, RedditProfile, RobloxOptions, RobloxProfile, SalesforceOptions, SalesforceProfile, SlackOptions, SlackProfile, SocialProvider, SocialProviderList, SocialProviderListEnum, SocialProviders, SpotifyOptions, SpotifyProfile, TiktokOptions, TiktokProfile, TwitchOptions, TwitchProfile, TwitterOption, TwitterProfile, VercelOptions, VercelProfile, VkOption, VkProfile, ZoomOptions, ZoomProfile, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, github, gitlab, google, huggingface, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, vk, zoom };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/core",
-  "version": "1.4.11-beta.2",
+  "version": "1.4.11",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "repository": {
@@ -139,6 +139,6 @@
     "lint:types": "attw --profile esm-only --pack .",
     "typecheck": "tsc --project tsconfig.json",
     "test": "vitest",
-    "coverage": "vitest run --coverage"
+    "coverage": "vitest run --coverage --coverage.provider=istanbul"
   }
 }

package/src/types/init-options.ts

@@ -151,17 +151,32 @@ export type BetterAuthAdvancedOptions = {
 	 */
 	useSecureCookies?: boolean | undefined;
 	/**
-	 * Disable trusted origins check
+	 * Disable all CSRF protection.
+	 *
+	 * When enabled, this disables:
+	 * - Origin header validation when cookies are present
+	 * - Fetch Metadata checks (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest)
+	 * - Cross-site navigation blocking for first-login scenarios
 	 *
 	 * ⚠︎ This is a security risk and it may expose your application to
 	 * CSRF attacks
+	 *
+	 * @default false
 	 */
 	disableCSRFCheck?: boolean | undefined;
 	/**
-	 * Disable origin check
+	 * Disable URL validation against trustedOrigins.
 	 *
-	 * ⚠︎ This may allow requests from any origin to be processed by
-	 * Better Auth. And could lead to security vulnerabilities.
+	 * When enabled, this disables validation of:
+	 * - callbackURL
+	 * - redirectTo
+	 * - errorCallbackURL
+	 * - newUserCallbackURL
+	 *
+	 * ⚠︎ This may allow open redirects and could lead to security
+	 * vulnerabilities.
+	 *
+	 * @default false
 	 */
 	disableOriginCheck?: boolean | undefined;
 	/**