@better-auth/core 1.6.23 → 1.6.25

package/src/db/adapter/get-default-model-name.ts

@@ -20,26 +20,35 @@ export const initGetDefaultModelName = ({
 	 * 3. Using this function helps us get the actual model name based on the user's defined custom modelName.
 	 */
 	const getDefaultModelName = (model: string) => {
+		// Resolve a model string (either a schema key or a user-defined
+		// `modelName`) back to its canonical schema key.
+		//
+		// An exact schema-key match must win over a `modelName` match.
+		// Better-auth internals (and `references.model`, see get-tables.ts)
+		// always pass canonical schema keys, so when a user remaps a
+		// built-in table onto another table's schema key (e.g.
+		// `user.modelName = "account"`), preferring the modelName alias
+		// would silently reroute every internal "account" query to the
+		// user table. The modelName lookup is only a fallback for
+		// externally supplied physical table names.
+		// @see https://github.com/better-auth/better-auth/issues/8111
+		// @see https://github.com/better-auth/better-auth/issues/10136
+		const resolve = (candidate: string): string | undefined => {
+			if (schema[candidate]) return candidate;
+			return Object.entries(schema).find(
+				([_, f]) => f.modelName === candidate,
+			)?.[0];
+		};
+
 		// It's possible this `model` could had applied `usePlural`.
 		// Thus we'll try the search but without the trailing `s`.
 		if (usePlural && model.charAt(model.length - 1) === "s") {
 			const pluralessModel = model.slice(0, -1);
-			let m = schema[pluralessModel] ? pluralessModel : undefined;
-			if (!m) {
-				m = Object.entries(schema).find(
-					([_, f]) => f.modelName === pluralessModel,
-				)?.[0];
-			}
-
-			if (m) {
-				return m;
-			}
+			const m = resolve(pluralessModel);
+			if (m) return m;
 		}
 
-		let m = schema[model] ? model : undefined;
-		if (!m) {
-			m = Object.entries(schema).find(([_, f]) => f.modelName === model)?.[0];
-		}
+		const m = resolve(model);
 
 		if (!m) {
 			throw new BetterAuthError(`Model "${model}" not found in schema`);

package/src/db/get-tables.ts

@@ -142,7 +142,18 @@ export const getAuthTables = (
 					type: "string",
 					fieldName: options.session?.fields?.userId || "userId",
 					references: {
-						model: options.user?.modelName || "user",
+						// Use the canonical user schema key here rather than
+						// `options.user.modelName`. Downstream consumers (e.g.
+						// `getSchema`, `getMigrations`, and the runtime adapter
+						// resolvers) treat `references.model` as a schema key
+						// and look it up via `tables[references.model]` /
+						// `getDefaultModelName`. Writing the modelName alias
+						// here would collide when a user picks a modelName that
+						// matches another schema key (for example
+						// `user.modelName = "account"`), causing the FK to
+						// resolve to the wrong table.
+						// @see https://github.com/better-auth/better-auth/issues/8111
+						model: "user",
 						field: "id",
 						onDelete: "cascade",
 					},
@@ -225,7 +236,11 @@ export const getAuthTables = (
 				userId: {
 					type: "string",
 					references: {
-						model: options.user?.modelName || "user",
+						// See note on `session.userId.references.model` above:
+						// always use the canonical user schema key so the FK
+						// target survives `user.modelName` aliasing.
+						// @see https://github.com/better-auth/better-auth/issues/8111
+						model: "user",
 						field: "id",
 						onDelete: "cascade",
 					},

package/src/oauth2/oauth-provider.ts

@@ -1,4 +1,8 @@
-import type { Awaitable, LiteralString } from "../types";
+import type {
+	Awaitable,
+	GenericEndpointContext,
+	LiteralString,
+} from "../types";
 
 export interface OAuth2Tokens {
 	tokenType?: string | undefined;
@@ -74,10 +78,15 @@ export interface OAuthProvider<
 	 * Verify the id token
 	 * @param token - The id token
 	 * @param nonce - The nonce
+	 * @param ctx - Request endpoint context (headers via `ctx.headers`)
 	 * @returns True if the id token is valid, false otherwise
 	 */
 	verifyIdToken?:
-		| ((token: string, nonce?: string) => Promise<boolean>)
+		| ((
+				token: string,
+				nonce?: string,
+				ctx?: GenericEndpointContext,
+		  ) => Promise<boolean>)
 		| undefined;
 	/**
 	 * Disable implicit sign up for new users. When set to true for the provider,
@@ -137,10 +146,17 @@ export type ProviderOptions<Profile extends Record<string, any> = any> = {
 	 */
 	disableIdTokenSignIn?: boolean | undefined;
 	/**
-	 * verifyIdToken function to verify the id token
+	 * Custom function to verify the id token.
+	 * @param token - The id token
+	 * @param nonce - The nonce
+	 * @param ctx - Request endpoint context (headers via `ctx.headers`)
 	 */
 	verifyIdToken?:
-		| ((token: string, nonce?: string) => Promise<boolean>)
+		| ((
+				token: string,
+				nonce?: string,
+				ctx?: GenericEndpointContext,
+		  ) => Promise<boolean>)
 		| undefined;
 	/**
 	 * Custom function to get user info from the provider

package/src/social-providers/apple.ts

@@ -10,6 +10,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 export interface AppleProfile {
 	/**
 	 * The subject registered claim identifies the principal that’s the subject
@@ -100,7 +101,7 @@ export const apple = (options: AppleOptions) => {
 	return {
 		id: "apple",
 		name: "Apple",
-		async createAuthorizationURL({ state, scopes, redirectURI }) {
+		async createAuthorizationURL({ state, scopes, redirectURI, codeVerifier }) {
 			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
 				logger.error(
 					"Client ID and client secret are required for Apple. Make sure to provide them in the options.",
@@ -117,6 +118,7 @@ export const apple = (options: AppleOptions) => {
 				scopes: _scope,
 				state,
 				redirectURI,
+				codeVerifier,
 				responseMode: "form_post",
 				responseType: "code id_token",
 			});
@@ -131,12 +133,16 @@ export const apple = (options: AppleOptions) => {
 				tokenEndpoint,
 			});
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
 				return false;
 			}
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
 			try {
 				const decodedHeader = decodeProtectedHeader(token);

package/src/social-providers/cognito.ts

@@ -9,6 +9,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
 export interface CognitoProfile {
 	sub: string;
@@ -130,12 +131,16 @@ export const cognito = (options: CognitoOptions) => {
 					});
 				},
 
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
 				return false;
 			}
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
 
 			try {

package/src/social-providers/facebook.ts

@@ -9,6 +9,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 export interface FacebookProfile {
 	id: string;
 	name: string;
@@ -130,13 +131,17 @@ export const facebook = (options: FacebookOptions) => {
 				tokenEndpoint: "https://graph.facebook.com/v24.0/oauth/access_token",
 			});
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
 				return false;
 			}
 
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
 
 			/* limited login */

package/src/social-providers/google.ts

@@ -10,6 +10,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
 export interface GoogleProfile {
 	aud: string;
@@ -181,12 +182,16 @@ export const google = (options: GoogleOptions) => {
 						tokenEndpoint: "https://oauth2.googleapis.com/token",
 					});
 				},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
 				return false;
 			}
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
 
 			const jwtClaims = await verifyGoogleIdToken({

package/src/social-providers/line.ts

@@ -6,6 +6,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
 export interface LineIdTokenPayload {
 	iss: string;
@@ -94,12 +95,16 @@ export const line = (options: LineOptions) => {
 						tokenEndpoint,
 					});
 				},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
 				return false;
 			}
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
 			const body = new URLSearchParams();
 			body.set("id_token", token);

package/src/social-providers/microsoft-entra-id.ts

@@ -10,6 +10,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
 /**
  * Microsoft's fixed tenant id for personal (consumer) Microsoft accounts. Every
@@ -200,12 +201,16 @@ export const microsoft = (options: MicrosoftOptions) => {
 				tokenEndpoint,
 			});
 		},
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
 				return false;
 			}
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
 
 			try {

package/src/social-providers/paypal.ts

@@ -5,6 +5,7 @@ import { logger } from "../env";
 import { APIError, BetterAuthError } from "../error";
 import type { OAuthProvider, ProviderOptions } from "../oauth2";
 import { createAuthorizationURL } from "../oauth2";
+import type { GenericEndpointContext } from "../types";
 
 /**
  * ID token signing algorithms advertised by PayPal's OpenID configuration.
@@ -217,12 +218,16 @@ export const paypal = (options: PayPalOptions) => {
 					}
 				},
 
-		async verifyIdToken(token, nonce) {
+		async verifyIdToken(
+			token: string,
+			nonce?: string,
+			ctx?: GenericEndpointContext,
+		) {
 			if (options.disableIdTokenSignIn) {
 				return false;
 			}
 			if (options.verifyIdToken) {
-				return options.verifyIdToken(token, nonce);
+				return options.verifyIdToken(token, nonce, ctx);
 			}
 
 			// Cryptographically verify the ID token. Decoding alone is not enough: