@better-auth/core 1.7.0-beta.0 → 1.7.0-beta.10

package/dist/social-providers/apple.mjs

@@ -1,8 +1,10 @@
-import { APIError } from "../error/index.mjs";
+import { APIError, BetterAuthError } from "../error/index.mjs";
+import { logger } from "../env/logger.mjs";
+import { getPrimaryClientId } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
-import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+import { decodeJwt, importJWK } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/apple.ts
 const apple = (options) => {
@@ -10,7 +12,11 @@ const apple = (options) => {
 	return {
 		id: "apple",
 		name: "Apple",
-		async createAuthorizationURL({ state, scopes, redirectURI }) {
+		async createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
+			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
+				logger.error("Client ID and client secret are required for Apple. Make sure to provide them in the options.");
+				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+			}
 			const _scope = options.disableDefaultScope ? [] : ["email", "name"];
 			if (options.scope) _scope.push(...options.scope);
 			if (scopes) _scope.push(...scopes);
@@ -22,7 +28,8 @@ const apple = (options) => {
 				state,
 				redirectURI,
 				responseMode: "form_post",
-				responseType: "code id_token"
+				responseType: "code id_token",
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
@@ -34,26 +41,12 @@ const apple = (options) => {
 				tokenEndpoint
 			});
 		},
-		async verifyIdToken(token, nonce) {
-			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
-			try {
-				const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
-				if (!kid || !jwtAlg) return false;
-				const { payload: jwtClaims } = await jwtVerify(token, await getApplePublicKey(kid), {
-					algorithms: [jwtAlg],
-					issuer: "https://appleid.apple.com",
-					audience: options.audience && options.audience.length ? options.audience : options.appBundleIdentifier ? options.appBundleIdentifier : options.clientId,
-					maxTokenAge: "1h"
-				});
-				["email_verified", "is_private_email"].forEach((field) => {
-					if (jwtClaims[field] !== void 0) jwtClaims[field] = Boolean(jwtClaims[field]);
-				});
-				if (nonce && jwtClaims.nonce !== nonce) return false;
-				return !!jwtClaims;
-			} catch {
-				return false;
-			}
+		idToken: {
+			jwks: (header) => getApplePublicKey(header.kid),
+			issuer: "https://appleid.apple.com",
+			audience: options.audience && options.audience.length ? options.audience : options.appBundleIdentifier ? options.appBundleIdentifier : options.clientId,
+			maxTokenAge: "1h",
+			nonceComparison: "exact-or-sha256"
 		},
 		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
 			return refreshAccessToken({

package/dist/social-providers/atlassian.d.mts

@@ -25,7 +25,8 @@ declare const atlassian: (options: AtlassianOptions) => {
     state,
     scopes,
     codeVerifier,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -33,6 +34,8 @@ declare const atlassian: (options: AtlassianOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -46,6 +49,7 @@ declare const atlassian: (options: AtlassianOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/atlassian.mjs

@@ -1,5 +1,5 @@
-import { logger } from "../env/logger.mjs";
 import { BetterAuthError } from "../error/index.mjs";
+import { logger } from "../env/logger.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
@@ -10,7 +10,7 @@ const atlassian = (options) => {
 	return {
 		id: "atlassian",
 		name: "Atlassian",
-		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			if (!options.clientId || !options.clientSecret) {
 				logger.error("Client Id and Secret are required for Atlassian");
 				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
@@ -27,7 +27,10 @@ const atlassian = (options) => {
 				state,
 				codeVerifier,
 				redirectURI,
-				additionalParams: { audience: "api.atlassian.com" },
+				additionalParams: {
+					...additionalParams ?? {},
+					audience: "api.atlassian.com"
+				},
 				prompt: options.prompt
 			});
 		},

package/dist/social-providers/cognito.d.mts

@@ -1,4 +1,6 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import * as jose from "jose";
+
 //#region src/social-providers/cognito.d.ts
 interface CognitoProfile {
   sub: string;
@@ -19,7 +21,7 @@ interface CognitoProfile {
   [key: string]: any;
 }
 interface CognitoOptions extends ProviderOptions<CognitoProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * The Cognito domain (e.g., "your-app.auth.us-east-1.amazoncognito.com")
    */
@@ -30,6 +32,19 @@ interface CognitoOptions extends ProviderOptions<CognitoProfile> {
   region: string;
   userPoolId: string;
   requireClientSecret?: boolean | undefined;
+  /**
+   * Skip the Cognito hosted-UI identity-provider picker by preselecting an
+   * IdP (maps to the `identity_provider` query parameter on the authorize
+   * request). Accepts `"COGNITO"`, a SAML/OIDC provider name configured on
+   * the User Pool, or one of the social providers (`"Google"`, `"Facebook"`,
+   * `"LoginWithAmazon"`, `"SignInWithApple"`).
+   *
+   * Per-request overrides via `signIn.social({ additionalParams: { identity_provider } })`
+   * take precedence over this value.
+   *
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
+   */
+  identityProvider?: string | undefined;
 }
 declare const cognito: (options: CognitoOptions) => {
   id: "cognito";
@@ -38,7 +53,8 @@ declare const cognito: (options: CognitoOptions) => {
     state,
     scopes,
     codeVerifier,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -46,6 +62,8 @@ declare const cognito: (options: CognitoOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -58,8 +76,14 @@ declare const cognito: (options: CognitoOptions) => {
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  idToken: {
+    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    issuer: string;
+    audience: string | string[];
+    maxTokenAge: string;
+  };
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/cognito.mjs

@@ -1,9 +1,10 @@
-import { logger } from "../env/logger.mjs";
 import { APIError, BetterAuthError } from "../error/index.mjs";
+import { logger } from "../env/logger.mjs";
+import { getPrimaryClientId } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
-import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
+import { decodeJwt, importJWK } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/cognito.ts
 const cognito = (options) => {
@@ -18,8 +19,8 @@ const cognito = (options) => {
 	return {
 		id: "cognito",
 		name: "Cognito",
-		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
-			if (!options.clientId) {
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
+			if (!getPrimaryClientId(options.clientId)) {
 				logger.error("ClientId is required for Amazon Cognito. Make sure to provide them in the options.");
 				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
 			}
@@ -42,7 +43,11 @@ const cognito = (options) => {
 				state,
 				codeVerifier,
 				redirectURI,
-				prompt: options.prompt
+				prompt: options.prompt,
+				additionalParams: {
+					...options.identityProvider ? { identity_provider: options.identityProvider } : {},
+					...additionalParams ?? {}
+				}
 			});
 			const scopeValue = url.searchParams.get("scope");
 			if (scopeValue) {
@@ -74,26 +79,11 @@ const cognito = (options) => {
 				tokenEndpoint
 			});
 		},
-		async verifyIdToken(token, nonce) {
-			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
-			try {
-				const { kid, alg: jwtAlg } = decodeProtectedHeader(token);
-				if (!kid || !jwtAlg) return false;
-				const publicKey = await getCognitoPublicKey(kid, options.region, options.userPoolId);
-				const expectedIssuer = `https://cognito-idp.${options.region}.amazonaws.com/${options.userPoolId}`;
-				const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
-					algorithms: [jwtAlg],
-					issuer: expectedIssuer,
-					audience: options.clientId,
-					maxTokenAge: "1h"
-				});
-				if (nonce && jwtClaims.nonce !== nonce) return false;
-				return true;
-			} catch (error) {
-				logger.error("Failed to verify ID token:", error);
-				return false;
-			}
+		idToken: {
+			jwks: (header) => getCognitoPublicKey(header.kid, options.region, options.userPoolId),
+			issuer: `https://cognito-idp.${options.region}.amazonaws.com/${options.userPoolId}`,
+			audience: options.clientId,
+			maxTokenAge: "1h"
 		},
 		async getUserInfo(token) {
 			if (options.getUserInfo) return options.getUserInfo(token);

package/dist/social-providers/discord.d.mts

@@ -38,7 +38,7 @@ interface DiscordProfile extends Record<string, any> {
   /** whether the email on this account has been verified */
   verified: boolean;
   /** the user's email */
-  email: string;
+  email?: string | null;
   /**
    * the flags on a user's account:
    * https://discord.com/developers/docs/resources/user#user-object-user-flags
@@ -80,7 +80,8 @@ declare const discord: (options: DiscordOptions) => {
   createAuthorizationURL({
     state,
     scopes,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -88,7 +89,9 @@ declare const discord: (options: DiscordOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
-  }): URL;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
+  }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
     redirectURI
@@ -100,6 +103,7 @@ declare const discord: (options: DiscordOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/discord.mjs

@@ -1,3 +1,4 @@
+import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
 import { betterFetch } from "@better-fetch/fetch";
@@ -7,12 +8,24 @@ const discord = (options) => {
 	return {
 		id: "discord",
 		name: "Discord",
-		createAuthorizationURL({ state, scopes, redirectURI }) {
+		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["identify", "email"];
 			if (scopes) _scopes.push(...scopes);
 			if (options.scope) _scopes.push(...options.scope);
-			const permissionsParam = _scopes.includes("bot") && options.permissions !== void 0 ? `&permissions=${options.permissions}` : "";
-			return new URL(`https://discord.com/api/oauth2/authorize?scope=${_scopes.join("+")}&response_type=code&client_id=${options.clientId}&redirect_uri=${encodeURIComponent(options.redirectURI || redirectURI)}&state=${state}&prompt=${options.prompt || "none"}${permissionsParam}`);
+			const hasBotScope = _scopes.includes("bot");
+			return createAuthorizationURL({
+				id: "discord",
+				options,
+				authorizationEndpoint: "https://discord.com/api/oauth2/authorize",
+				scopes: _scopes,
+				state,
+				redirectURI,
+				prompt: options.prompt || "none",
+				additionalParams: {
+					...hasBotScope && options.permissions !== void 0 ? { permissions: String(options.permissions) } : {},
+					...additionalParams ?? {}
+				}
+			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {
 			return validateAuthorizationCode({

package/dist/social-providers/dropbox.d.mts

@@ -24,7 +24,8 @@ declare const dropbox: (options: DropboxOptions) => {
     state,
     scopes,
     codeVerifier,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -32,6 +33,8 @@ declare const dropbox: (options: DropboxOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }) => Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -45,6 +48,7 @@ declare const dropbox: (options: DropboxOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/dropbox.mjs

@@ -8,12 +8,10 @@ const dropbox = (options) => {
 	return {
 		id: "dropbox",
 		name: "Dropbox",
-		createAuthorizationURL: async ({ state, scopes, codeVerifier, redirectURI }) => {
+		createAuthorizationURL: async ({ state, scopes, codeVerifier, redirectURI, additionalParams }) => {
 			const _scopes = options.disableDefaultScope ? [] : ["account_info.read"];
 			if (options.scope) _scopes.push(...options.scope);
 			if (scopes) _scopes.push(...scopes);
-			const additionalParams = {};
-			if (options.accessType) additionalParams.token_access_type = options.accessType;
 			return await createAuthorizationURL({
 				id: "dropbox",
 				options,
@@ -22,7 +20,10 @@ const dropbox = (options) => {
 				state,
 				redirectURI,
 				codeVerifier,
-				additionalParams
+				additionalParams: {
+					...options.accessType ? { token_access_type: options.accessType } : {},
+					...additionalParams ?? {}
+				}
 			});
 		},
 		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {

package/dist/social-providers/facebook.d.mts

@@ -1,10 +1,12 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import * as jose from "jose";
+
 //#region src/social-providers/facebook.d.ts
 interface FacebookProfile {
   id: string;
   name: string;
-  email: string;
-  email_verified: boolean;
+  email?: string;
+  email_verified?: boolean;
   picture: {
     data: {
       height: number;
@@ -15,7 +17,7 @@ interface FacebookProfile {
   };
 }
 interface FacebookOptions extends ProviderOptions<FacebookProfile> {
-  clientId: string;
+  clientId: string | string[];
   /**
    * Extend list of fields to retrieve from the Facebook user profile.
    *
@@ -34,7 +36,8 @@ declare const facebook: (options: FacebookOptions) => {
     state,
     scopes,
     redirectURI,
-    loginHint
+    loginHint,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -42,6 +45,8 @@ declare const facebook: (options: FacebookOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -52,9 +57,23 @@ declare const facebook: (options: FacebookOptions) => {
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  idToken: {
+    jwks: {
+      (protectedHeader?: jose.JWSHeaderParameters, token?: jose.FlattenedJWSInput): Promise<jose.CryptoKey>;
+      coolingDown: boolean;
+      fresh: boolean;
+      reloading: boolean;
+      reload: () => Promise<void>;
+      jwks: () => jose.JSONWebKeySet | undefined;
+    };
+    issuer: string;
+    audience: string | string[];
+    algorithms: string[];
+    allowOpaqueToken: true;
+  };
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/facebook.mjs

@@ -1,14 +1,49 @@
+import { BetterAuthError } from "../error/index.mjs";
+import { logger } from "../env/logger.mjs";
+import { getPrimaryClientId } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
-import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
+import { createRemoteJWKSet, decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/facebook.ts
+/**
+* Validate an opaque Facebook access token against the configured app.
+*
+* Facebook access tokens are not audience-bound at the Graph `/me` endpoint: a
+* token minted for any Facebook app returns that app's profile. Without this
+* check, a token issued to an unrelated app could be presented to this
+* app's direct sign-in path and accepted as proof of identity. We call the
+* `debug_token` endpoint and require the token to be valid, bound to one of the
+* configured client ids, and tied to a user.
+*
+* @see https://developers.facebook.com/docs/facebook-login/guides/access-tokens/debugging
+*
+* @returns the inspected token's `user_id` when the token is valid and bound to
+* the configured app, otherwise `null`.
+*/
+async function verifyFacebookAccessToken(accessToken, options) {
+	const primaryClientId = getPrimaryClientId(options.clientId);
+	if (!primaryClientId || !options.clientSecret) return null;
+	const clientIds = Array.isArray(options.clientId) ? options.clientId : [options.clientId];
+	const { data, error } = await betterFetch("https://graph.facebook.com/debug_token", { query: {
+		input_token: accessToken,
+		access_token: `${primaryClientId}|${options.clientSecret}`
+	} });
+	if (error || !data?.data) return null;
+	const { is_valid, app_id, user_id } = data.data;
+	if (is_valid !== true || !app_id || !clientIds.includes(app_id) || !user_id) return null;
+	return user_id;
+}
 const facebook = (options) => {
 	return {
 		id: "facebook",
 		name: "Facebook",
-		async createAuthorizationURL({ state, scopes, redirectURI, loginHint }) {
+		async createAuthorizationURL({ state, scopes, redirectURI, loginHint, additionalParams }) {
+			if (!getPrimaryClientId(options.clientId) || !options.clientSecret) {
+				logger.error("Client ID and client secret are required for Facebook. Make sure to provide them in the options.");
+				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
+			}
 			const _scopes = options.disableDefaultScope ? [] : ["email", "public_profile"];
 			if (options.scope) _scopes.push(...options.scope);
 			if (scopes) _scopes.push(...scopes);
@@ -20,7 +55,10 @@ const facebook = (options) => {
 				state,
 				redirectURI,
 				loginHint,
-				additionalParams: options.configId ? { config_id: options.configId } : {}
+				additionalParams: {
+					...options.configId ? { config_id: options.configId } : {},
+					...additionalParams ?? {}
+				}
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {
@@ -31,21 +69,12 @@ const facebook = (options) => {
 				tokenEndpoint: "https://graph.facebook.com/v24.0/oauth/access_token"
 			});
 		},
-		async verifyIdToken(token, nonce) {
-			if (options.disableIdTokenSignIn) return false;
-			if (options.verifyIdToken) return options.verifyIdToken(token, nonce);
-			if (token.split(".").length === 3) try {
-				const { payload: jwtClaims } = await jwtVerify(token, createRemoteJWKSet(new URL("https://limited.facebook.com/.well-known/oauth/openid/jwks/")), {
-					algorithms: ["RS256"],
-					audience: options.clientId,
-					issuer: "https://www.facebook.com"
-				});
-				if (nonce && jwtClaims.nonce !== nonce) return false;
-				return !!jwtClaims;
-			} catch {
-				return false;
-			}
-			return true;
+		idToken: {
+			jwks: createRemoteJWKSet(new URL("https://limited.facebook.com/.well-known/oauth/openid/jwks/")),
+			issuer: "https://www.facebook.com",
+			audience: options.clientId,
+			algorithms: ["RS256"],
+			allowOpaqueToken: true
 		},
 		refreshAccessToken: options.refreshAccessToken ? options.refreshAccessToken : async (refreshToken) => {
 			return refreshAccessToken({
@@ -86,6 +115,10 @@ const facebook = (options) => {
 					data: profile
 				};
 			}
+			const accessToken = token.accessToken;
+			if (!accessToken) return null;
+			const tokenUserId = await verifyFacebookAccessToken(accessToken, options);
+			if (!tokenUserId) return null;
 			const { data: profile, error } = await betterFetch("https://graph.facebook.com/me?fields=" + [
 				"id",
 				"name",
@@ -94,9 +127,10 @@ const facebook = (options) => {
 				...options?.fields || []
 			].join(","), { auth: {
 				type: "Bearer",
-				token: token.accessToken
+				token: accessToken
 			} });
 			if (error) return null;
+			if (profile.id !== tokenUserId) return null;
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
@@ -104,7 +138,7 @@ const facebook = (options) => {
 					name: profile.name,
 					email: profile.email,
 					image: profile.picture.data.url,
-					emailVerified: profile.email_verified,
+					emailVerified: profile.email_verified ?? false,
 					...userMap
 				},
 				data: profile

package/dist/social-providers/figma.d.mts

@@ -16,7 +16,8 @@ declare const figma: (options: FigmaOptions) => {
     state,
     scopes,
     codeVerifier,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -24,6 +25,8 @@ declare const figma: (options: FigmaOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -37,6 +40,7 @@ declare const figma: (options: FigmaOptions) => {
   }) => Promise<OAuth2Tokens>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;

package/dist/social-providers/figma.mjs

@@ -1,5 +1,5 @@
-import { logger } from "../env/logger.mjs";
 import { BetterAuthError } from "../error/index.mjs";
+import { logger } from "../env/logger.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
@@ -10,7 +10,7 @@ const figma = (options) => {
 	return {
 		id: "figma",
 		name: "Figma",
-		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI }) {
+		async createAuthorizationURL({ state, scopes, codeVerifier, redirectURI, additionalParams }) {
 			if (!options.clientId || !options.clientSecret) {
 				logger.error("Client Id and Client Secret are required for Figma. Make sure to provide them in the options.");
 				throw new BetterAuthError("CLIENT_ID_AND_SECRET_REQUIRED");
@@ -26,7 +26,8 @@ const figma = (options) => {
 				scopes: _scopes,
 				state,
 				codeVerifier,
-				redirectURI
+				redirectURI,
+				additionalParams
 			});
 		},
 		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {

package/dist/social-providers/github.d.mts

@@ -23,7 +23,7 @@ interface GithubProfile {
   company: string;
   blog: string;
   location: string;
-  email: string;
+  email: string | null;
   hireable: boolean;
   bio: string;
   twitter_username: string;
@@ -57,7 +57,8 @@ declare const github: (options: GithubOptions) => {
     scopes,
     loginHint,
     codeVerifier,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -65,6 +66,8 @@ declare const github: (options: GithubOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -78,6 +81,7 @@ declare const github: (options: GithubOptions) => {
   }) => Promise<OAuth2Tokens | null>;
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;