@better-auth/core 1.7.0-beta.9 → 1.7.0-rc.1

package/dist/context/global.mjs

@@ -2,7 +2,7 @@
 const symbol = Symbol.for("better-auth:global");
 let bind = null;
 const __context = {};
-const __betterAuthVersion = "1.7.0-beta.9";
+const __betterAuthVersion = "1.7.0-rc.1";
 /**
 * We store context instance in the globalThis.
 *

package/dist/db/adapter/factory.mjs

@@ -458,6 +458,7 @@ const createAdapterFactory = ({ adapter: customAdapter, config: cfg }) => (optio
 				where: unsafeWhere,
 				action: "update"
 			});
+			if (where.length === 0) return null;
 			debugLog({ method: "update" }, `${formatTransactionId(thisTransactionId)} ${formatStep(1, 4)}`, `${formatMethod("update")} ${formatAction("Unsafe Input")}:`, {
 				model,
 				data: unsafeData

package/dist/db/adapter/index.d.mts

@@ -396,8 +396,14 @@ type DBAdapter<Options extends BetterAuthOptions = BetterAuthOptions> = {
     where?: Where[] | undefined;
   }) => Promise<number>;
   /**
-   * ⚠︎ Update may not return the updated data
-   * if multiple where clauses are provided
+   * Update a single row matching the where clause.
+   *
+   * Returns the updated row, or `null` when no row matched. Empty `where`
+   * clauses return `null`; use `updateMany` for intentional bulk updates.
+   *
+   * This is not the race-safe primitive for guarded state transitions. Use
+   * `incrementOne` when the predicate is both selector and guard, and use
+   * `consumeOne` for single-use destructive reads.
    */
   update: <T>(data: {
     model: string;

package/dist/db/get-tables.mjs

@@ -8,7 +8,8 @@ const getAuthTables = (options) => {
 				...acc[key]?.fields,
 				...value.fields
 			},
-			modelName: value.modelName || key
+			modelName: value.modelName || key,
+			disableMigrations: value.disableMigration ?? acc[key]?.disableMigrations
 		};
 		return acc;
 	}, {});

package/dist/error/index.d.mts

@@ -7,7 +7,14 @@ declare class BetterAuthError extends Error {
     cause?: unknown | undefined;
   });
 }
+type BaseAPIErrorInstance = InstanceType<typeof APIError$1>;
 declare class APIError extends APIError$1 {
+  status: BaseAPIErrorInstance["status"];
+  body: BaseAPIErrorInstance["body"];
+  headers: BaseAPIErrorInstance["headers"];
+  statusCode: BaseAPIErrorInstance["statusCode"];
+  message: string;
+  errorStack: BaseAPIErrorInstance["errorStack"];
   constructor(...args: ConstructorParameters<typeof APIError$1>);
   static fromStatus(status: ConstructorParameters<typeof APIError$1>[0], body?: ConstructorParameters<typeof APIError$1>[1]): APIError;
   static from(status: ConstructorParameters<typeof APIError$1>[0], error: {

package/dist/instrumentation/tracer.mjs

@@ -2,7 +2,7 @@ import { ATTR_HTTP_RESPONSE_STATUS_CODE } from "./attributes.mjs";
 import { getOpenTelemetryAPI } from "./api.mjs";
 //#region src/instrumentation/tracer.ts
 const INSTRUMENTATION_SCOPE = "better-auth";
-const INSTRUMENTATION_VERSION = "1.7.0-beta.9";
+const INSTRUMENTATION_VERSION = "1.7.0-rc.1";
 /**
 * Better-auth uses `throw ctx.redirect(url)` for flow control (e.g. OAuth
 * callbacks). These are APIErrors with 3xx status codes and should not be

package/dist/oauth2/client-credentials-token.mjs

@@ -1,5 +1,5 @@
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { applyTokenEndpointAuth } from "./token-endpoint-auth.mjs";
-import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/client-credentials-token.ts
 async function clientCredentialsTokenRequest({ options, scope, authentication, tokenEndpointAuth, tokenEndpoint, resource }) {
 	options = typeof options === "function" ? await options() : options;
@@ -46,7 +46,7 @@ async function clientCredentialsToken({ options, tokenEndpoint, scope, authentic
 		tokenEndpoint,
 		resource
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers

package/dist/oauth2/refresh-access-token.mjs

@@ -1,6 +1,6 @@
 import { parseScopeField } from "./utils.mjs";
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { applyTokenEndpointAuth } from "./token-endpoint-auth.mjs";
-import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/refresh-access-token.ts
 const BLOCKED_REFRESH_TOKEN_PARAMS_SET = new Set([
 	"grant_type",
@@ -61,7 +61,7 @@ async function refreshAccessToken({ refreshToken, options, tokenEndpoint, authen
 		extraParams,
 		resource
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers

package/dist/oauth2/reject-redirects.mjs

@@ -0,0 +1,65 @@
+import { BetterAuthError } from "../error/index.mjs";
+import { betterFetch } from "@better-fetch/fetch";
+//#region src/oauth2/reject-redirects.ts
+const httpRedirectStatuses = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/**
+* Whether a response from a `redirect: "manual"` fetch is a redirect.
+*
+* Node/undici exposes the real 3xx status. Spec-compliant runtimes (Cloudflare
+* Workers, Deno, browsers) return an opaque-redirect filtered response with
+* status 0 and type `"opaqueredirect"`, so the status alone is not enough.
+*/
+function isRedirectResponse(response) {
+	return response.type === "opaqueredirect" || httpRedirectStatuses.has(response.status);
+}
+function redirectRefused(endpoint) {
+	return new BetterAuthError(`The OAuth endpoint "${endpoint}" returned an HTTP redirect. Server-side OAuth fetches refuse redirects to prevent SSRF; configure the final endpoint URL.`);
+}
+/**
+* Fetch option that refuses HTTP redirects portably.
+*
+* Cloudflare Workers (workerd) rejects `redirect: "error"`, so manual mode is
+* used and the resolved response is checked with {@link assertResponseNotRedirect}
+* (or, for betterFetch, with {@link fetchRefusingRedirects}).
+*/
+const noFollowRedirect = { redirect: "manual" };
+/**
+* Throw when a native-`fetch` response (e.g. jose's JWKS loader) resolved to a
+* redirect, so an attacker-influenced endpoint cannot bounce a server-side
+* request to an internal address.
+*/
+function assertResponseNotRedirect(endpoint, response) {
+	if (isRedirectResponse(response)) throw redirectRefused(endpoint);
+}
+/**
+* betterFetch that refuses HTTP redirects on a server-side OAuth fetch.
+*
+* Returns the betterFetch result and throws if the endpoint redirected, on both
+* undici (real 3xx status) and spec-compliant runtimes (opaque redirect, where
+* the error status is 0). The redirect is never followed on any runtime.
+*/
+async function fetchRefusingRedirects(url, options) {
+	let redirected = false;
+	const onError = options?.onError;
+	const result = await betterFetch(url, {
+		...options,
+		...noFollowRedirect,
+		async onError(context) {
+			if (isRedirectResponse(context.response)) redirected = true;
+			await onError?.(context);
+		}
+	}).catch((error) => {
+		if (redirected) throw redirectRefused(url);
+		throw error;
+	});
+	if (redirected) throw redirectRefused(url);
+	return result;
+}
+//#endregion
+export { assertResponseNotRedirect, fetchRefusingRedirects, noFollowRedirect };

package/dist/oauth2/validate-authorization-code.mjs

@@ -1,7 +1,7 @@
 import { getOAuth2Tokens } from "./utils.mjs";
+import { assertResponseNotRedirect, fetchRefusingRedirects, noFollowRedirect } from "./reject-redirects.mjs";
 import { applyTokenEndpointAuth } from "./token-endpoint-auth.mjs";
-import { createRemoteJWKSet, jwtVerify } from "jose";
-import { betterFetch } from "@better-fetch/fetch";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
 //#region src/oauth2/validate-authorization-code.ts
 async function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, tokenEndpointAuth, tokenEndpoint, deviceId, headers, additionalParams = {}, resource }) {
 	options = typeof options === "function" ? await options() : options;
@@ -61,7 +61,7 @@ async function validateAuthorizationCode({ code, codeVerifier, redirectURI, opti
 		additionalParams,
 		resource
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers: requestHeaders
@@ -70,7 +70,14 @@ async function validateAuthorizationCode({ code, codeVerifier, redirectURI, opti
 	return getOAuth2Tokens(data);
 }
 async function validateToken(token, jwksEndpoint, options) {
-	return await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint)), {
+	return await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: async (url, init) => {
+		const response = await fetch(url, {
+			...init,
+			...noFollowRedirect
+		});
+		assertResponseNotRedirect(String(url), response);
+		return response;
+	} }), {
 		audience: options?.audience,
 		issuer: options?.issuer
 	});

package/dist/oauth2/verify.mjs

@@ -1,8 +1,8 @@
 import { logger } from "../env/logger.mjs";
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
 import { createInMemoryDpopReplayStore, enforceDpopBinding, getDpopJktFromPayload, isDpopBindingError, parseAccessTokenAuthorization } from "./dpop.mjs";
 import { APIError } from "better-call";
 import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
-import { betterFetch } from "@better-fetch/fetch";
 //#region src/oauth2/verify.ts
 const joseInfrastructureErrorCodes = new Set([
 	errors.JWKSTimeout.code,
@@ -45,7 +45,7 @@ function shouldRefetchCachedJwksWithoutKid(error, resolved) {
 	return Date.now() - resolved.noKidRefetchedAt >= JWKS_NO_KID_REFETCH_COOLDOWN_MS;
 }
 async function fetchJwks(jwksFetch) {
-	const jwks = typeof jwksFetch === "string" ? await betterFetch(jwksFetch, { headers: { Accept: "application/json" } }).then(async (res) => {
+	const jwks = typeof jwksFetch === "string" ? await fetchRefusingRedirects(jwksFetch, { headers: { Accept: "application/json" } }).then(async (res) => {
 		if (res.error) throw new Error(`Jwks failed: ${res.error.message ?? res.error.statusText}`);
 		return res.data;
 	}) : await jwksFetch();
@@ -181,7 +181,7 @@ async function verifyAccessTokenPayload(token, opts) {
 		else throw new Error(error);
 	}
 	if (opts?.remoteVerify) {
-		const { data: introspect, error: introspectError } = await betterFetch(opts.remoteVerify.introspectUrl, {
+		const { data: introspect, error: introspectError } = await fetchRefusingRedirects(opts.remoteVerify.introspectUrl, {
 			method: "POST",
 			headers: {
 				Accept: "application/json",

package/dist/social-providers/google.d.mts

@@ -1,5 +1,6 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
 import * as jose from "jose";
+import { JWTPayload } from "jose";
 
 //#region src/social-providers/google.d.ts
 interface GoogleProfile {
@@ -43,8 +44,8 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    *
    * This is sent to Google as the `hd` authorization hint and, when set, is
    * also enforced against the `hd` claim of the returned id token/profile.
-   * Sign-in is rejected when the claim is missing or does not match, so this
-   * can be used to restrict sign-in to a Workspace domain.
+   * Set `hd: "*"` to require any Workspace hosted-domain claim. Sign-in is
+   * rejected when the claim is missing or does not satisfy this restriction.
    */
   hd?: string | undefined;
   /**
@@ -59,6 +60,25 @@ interface GoogleOptions extends ProviderOptions<GoogleProfile> {
    */
   includeGrantedScopes?: boolean | undefined;
 }
+interface VerifyGoogleIdTokenOptions {
+  token: string;
+  audience: string | string[];
+  nonce?: string | undefined;
+}
+/**
+ * Verifies a Google ID token against Google's issuer, audience, signature,
+ * expiry, and maximum token age.
+ */
+declare const verifyGoogleIdToken: ({
+  token,
+  audience,
+  nonce
+}: VerifyGoogleIdTokenOptions) => Promise<JWTPayload | null>;
+/**
+ * Checks whether Google's verified `hd` claim satisfies the configured hosted
+ * domain restriction. `hd: "*"` accepts any Google Workspace hosted domain.
+ */
+declare const isGoogleHostedDomainAllowed: (configuredHostedDomain: string | undefined, tokenHostedDomain: unknown) => boolean;
 declare const google: (options: GoogleOptions) => {
   id: "google";
   name: string;
@@ -122,4 +142,4 @@ declare const google: (options: GoogleOptions) => {
 };
 declare const getGooglePublicKey: (kid: string) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
 //#endregion
-export { GoogleOptions, GoogleProfile, getGooglePublicKey, google };
+export { GoogleOptions, GoogleProfile, VerifyGoogleIdTokenOptions, getGooglePublicKey, google, isGoogleHostedDomainAllowed, verifyGoogleIdToken };

package/dist/social-providers/google.mjs

@@ -4,9 +4,51 @@ import { getPrimaryClientId } from "../oauth2/utils.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { refreshAccessToken } from "../oauth2/refresh-access-token.mjs";
 import { validateAuthorizationCode } from "../oauth2/validate-authorization-code.mjs";
-import { decodeJwt, importJWK } from "jose";
+import { decodeJwt, decodeProtectedHeader, importJWK, jwtVerify } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/google.ts
+const GOOGLE_ID_TOKEN_MAX_AGE = "1h";
+const GOOGLE_ID_TOKEN_ALGORITHM = "RS256";
+const GOOGLE_ID_TOKEN_ALGORITHMS = [GOOGLE_ID_TOKEN_ALGORITHM];
+function isGoogleIdTokenAlgorithm(algorithm) {
+	return GOOGLE_ID_TOKEN_ALGORITHMS.includes(algorithm);
+}
+/**
+* Verifies a Google ID token against Google's issuer, audience, signature,
+* expiry, and maximum token age.
+*/
+const verifyGoogleIdToken = async ({ token, audience, nonce }) => {
+	try {
+		const { kid, alg } = decodeProtectedHeader(token);
+		if (!isGoogleIdTokenAlgorithm(alg)) return null;
+		const publicKeys = await getGooglePublicKeys(kid);
+		for (const publicKey of publicKeys) try {
+			const { payload: jwtClaims } = await jwtVerify(token, publicKey, {
+				algorithms: GOOGLE_ID_TOKEN_ALGORITHMS,
+				issuer: ["https://accounts.google.com", "accounts.google.com"],
+				audience,
+				maxTokenAge: GOOGLE_ID_TOKEN_MAX_AGE
+			});
+			if (nonce && jwtClaims.nonce !== nonce) return null;
+			return jwtClaims;
+		} catch {
+			continue;
+		}
+		return null;
+	} catch {
+		return null;
+	}
+};
+/**
+* Checks whether Google's verified `hd` claim satisfies the configured hosted
+* domain restriction. `hd: "*"` accepts any Google Workspace hosted domain.
+*/
+const isGoogleHostedDomainAllowed = (configuredHostedDomain, tokenHostedDomain) => {
+	if (!configuredHostedDomain) return true;
+	if (typeof tokenHostedDomain !== "string" || !tokenHostedDomain) return false;
+	if (configuredHostedDomain === "*") return true;
+	return tokenHostedDomain === configuredHostedDomain;
+};
 const google = (options) => {
 	return {
 		id: "google",
@@ -67,15 +109,15 @@ const google = (options) => {
 			jwks: (header) => getGooglePublicKey(header.kid),
 			issuer: ["https://accounts.google.com", "accounts.google.com"],
 			audience: options.clientId,
-			maxTokenAge: "1h",
-			verifyClaims: options.hd ? (claims) => claims.hd === options.hd : void 0
+			maxTokenAge: GOOGLE_ID_TOKEN_MAX_AGE,
+			verifyClaims: options.hd ? (claims) => isGoogleHostedDomainAllowed(options.hd, claims.hd) : void 0
 		},
 		async getUserInfo(token) {
 			if (options.getUserInfo) return options.getUserInfo(token);
 			if (!token.idToken) return null;
 			const user = decodeJwt(token.idToken);
-			if (options.hd && user.hd !== options.hd) {
-				logger.error(`Google sign-in rejected: id token hosted domain (hd) "${user.hd ?? "<missing>"}" does not match the configured "hd" option "${options.hd}".`);
+			if (!isGoogleHostedDomainAllowed(options.hd, user.hd)) {
+				logger.error(`Google sign-in rejected: id token hosted domain (hd) "${user.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${options.hd}".`);
 				return null;
 			}
 			const userMap = await options.mapProfileToUser?.(user);
@@ -95,11 +137,16 @@ const google = (options) => {
 	};
 };
 const getGooglePublicKey = async (kid) => {
+	const [publicKey] = await getGooglePublicKeys(kid);
+	if (!publicKey) throw new Error(`JWK with kid ${kid} not found`);
+	return publicKey;
+};
+const getGooglePublicKeys = async (kid) => {
 	const { data } = await betterFetch("https://www.googleapis.com/oauth2/v3/certs");
 	if (!data?.keys) throw new APIError("BAD_REQUEST", { message: "Keys not found" });
-	const jwk = data.keys.find((key) => key.kid === kid);
-	if (!jwk) throw new Error(`JWK with kid ${kid} not found`);
-	return await importJWK(jwk, jwk.alg);
+	const jwks = kid ? data.keys.filter((key) => key.kid === kid) : data.keys;
+	if (!jwks.length) throw new Error(`JWK with kid ${kid} not found`);
+	return Promise.all(jwks.map((jwk) => importJWK(jwk, GOOGLE_ID_TOKEN_ALGORITHM)));
 };
 //#endregion
-export { getGooglePublicKey, google };
+export { getGooglePublicKey, google, isGoogleHostedDomainAllowed, verifyGoogleIdToken };

package/dist/social-providers/index.d.mts

@@ -6,7 +6,7 @@ import { FacebookOptions, FacebookProfile, facebook } from "./facebook.mjs";
 import { FigmaOptions, FigmaProfile, figma } from "./figma.mjs";
 import { GithubOptions, GithubProfile, github } from "./github.mjs";
 import { MicrosoftEntraIDProfile, MicrosoftOptions, getMicrosoftPublicKey, microsoft } from "./microsoft-entra-id.mjs";
-import { GoogleOptions, GoogleProfile, getGooglePublicKey, google } from "./google.mjs";
+import { GoogleOptions, GoogleProfile, VerifyGoogleIdTokenOptions, getGooglePublicKey, google, isGoogleHostedDomainAllowed, verifyGoogleIdToken } from "./google.mjs";
 import { HuggingFaceOptions, HuggingFaceProfile, huggingface } from "./huggingface.mjs";
 import { SlackOptions, SlackProfile, slack } from "./slack.mjs";
 import { SpotifyOptions, SpotifyProfile, spotify } from "./spotify.mjs";
@@ -2007,4 +2007,4 @@ type SocialProviders = { [K in SocialProviderList[number]]?: AwaitableFunction<P
 }> };
 type SocialProviderList = typeof socialProviderList;
 //#endregion
-export { AccountStatus, AppleNonConformUser, AppleOptions, AppleProfile, AtlassianOptions, AtlassianProfile, CognitoOptions, CognitoProfile, DiscordOptions, DiscordProfile, DropboxOptions, DropboxProfile, FacebookOptions, FacebookProfile, FigmaOptions, FigmaProfile, GithubOptions, GithubProfile, GitlabOptions, GitlabProfile, GoogleOptions, GoogleProfile, HuggingFaceOptions, HuggingFaceProfile, KakaoOptions, KakaoProfile, KickOptions, KickProfile, LineIdTokenPayload, LineOptions, LineUserInfo, LinearOptions, LinearProfile, LinearUser, LinkedInOptions, LinkedInProfile, LoginType, MicrosoftEntraIDProfile, MicrosoftOptions, NaverOptions, NaverProfile, NotionOptions, NotionProfile, PayPalOptions, PayPalProfile, PayPalTokenResponse, PaybinOptions, PaybinProfile, PhoneNumber, PolarOptions, PolarProfile, PronounOption, RailwayOptions, RailwayProfile, RedditOptions, RedditProfile, RobloxOptions, RobloxProfile, SalesforceOptions, SalesforceProfile, SlackOptions, SlackProfile, SocialProvider, SocialProviderList, SocialProviderListEnum, SocialProviders, SpotifyOptions, SpotifyProfile, TiktokOptions, TiktokProfile, TwitchOptions, TwitchProfile, TwitterOption, TwitterProfile, VercelOptions, VercelProfile, VkOption, VkProfile, WeChatOptions, WeChatProfile, ZoomOptions, ZoomProfile, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, vk, wechat, zoom };
+export { AccountStatus, AppleNonConformUser, AppleOptions, AppleProfile, AtlassianOptions, AtlassianProfile, CognitoOptions, CognitoProfile, DiscordOptions, DiscordProfile, DropboxOptions, DropboxProfile, FacebookOptions, FacebookProfile, FigmaOptions, FigmaProfile, GithubOptions, GithubProfile, GitlabOptions, GitlabProfile, GoogleOptions, GoogleProfile, HuggingFaceOptions, HuggingFaceProfile, KakaoOptions, KakaoProfile, KickOptions, KickProfile, LineIdTokenPayload, LineOptions, LineUserInfo, LinearOptions, LinearProfile, LinearUser, LinkedInOptions, LinkedInProfile, LoginType, MicrosoftEntraIDProfile, MicrosoftOptions, NaverOptions, NaverProfile, NotionOptions, NotionProfile, PayPalOptions, PayPalProfile, PayPalTokenResponse, PaybinOptions, PaybinProfile, PhoneNumber, PolarOptions, PolarProfile, PronounOption, RailwayOptions, RailwayProfile, RedditOptions, RedditProfile, RobloxOptions, RobloxProfile, SalesforceOptions, SalesforceProfile, SlackOptions, SlackProfile, SocialProvider, SocialProviderList, SocialProviderListEnum, SocialProviders, SpotifyOptions, SpotifyProfile, TiktokOptions, TiktokProfile, TwitchOptions, TwitchProfile, TwitterOption, TwitterProfile, VercelOptions, VercelProfile, VerifyGoogleIdTokenOptions, VkOption, VkProfile, WeChatOptions, WeChatProfile, ZoomOptions, ZoomProfile, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };

package/dist/social-providers/index.mjs

@@ -7,7 +7,7 @@ import { facebook } from "./facebook.mjs";
 import { figma } from "./figma.mjs";
 import { github } from "./github.mjs";
 import { gitlab } from "./gitlab.mjs";
-import { getGooglePublicKey, google } from "./google.mjs";
+import { getGooglePublicKey, google, isGoogleHostedDomainAllowed, verifyGoogleIdToken } from "./google.mjs";
 import { huggingface } from "./huggingface.mjs";
 import { kakao } from "./kakao.mjs";
 import { kick } from "./kick.mjs";
@@ -75,4 +75,4 @@ const socialProviders = {
 const socialProviderList = Object.keys(socialProviders);
 const SocialProviderListEnum = z.enum(socialProviderList).or(z.string());
 //#endregion
-export { SocialProviderListEnum, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, vk, wechat, zoom };
+export { SocialProviderListEnum, apple, atlassian, cognito, discord, dropbox, facebook, figma, getApplePublicKey, getCognitoPublicKey, getGooglePublicKey, getMicrosoftPublicKey, github, gitlab, google, huggingface, isGoogleHostedDomainAllowed, kakao, kick, line, linear, linkedin, microsoft, naver, notion, paybin, paypal, polar, railway, reddit, roblox, salesforce, slack, socialProviderList, socialProviders, spotify, tiktok, twitch, twitter, vercel, verifyGoogleIdToken, vk, wechat, zoom };

package/dist/social-providers/paypal.d.mts

@@ -1,6 +1,7 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
 //#region src/social-providers/paypal.d.ts
 interface PayPalProfile {
+  sub?: string | undefined;
   user_id: string;
   name: string;
   given_name: string;

package/dist/social-providers/paypal.mjs

@@ -2,6 +2,7 @@ import { BetterAuthError } from "../error/index.mjs";
 import { logger } from "../env/logger.mjs";
 import { createAuthorizationURL } from "../oauth2/create-authorization-url.mjs";
 import { base64 } from "@better-auth/utils/base64";
+import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/social-providers/paypal.ts
 const paypal = (options) => {
@@ -106,6 +107,20 @@ const paypal = (options) => {
 					return null;
 				}
 				const userInfo = response.data;
+				if (token.idToken) {
+					let idTokenSubject;
+					try {
+						idTokenSubject = decodeJwt(token.idToken).sub;
+					} catch (error) {
+						logger.error("Failed to decode PayPal ID token:", error);
+						return null;
+					}
+					const userInfoSubject = userInfo.sub ?? userInfo.user_id;
+					if (!idTokenSubject || userInfoSubject !== idTokenSubject) {
+						logger.error("PayPal user info subject does not match ID token subject");
+						return null;
+					}
+				}
 				const userMap = await options.mapProfileToUser?.(userInfo);
 				return {
 					user: {

package/dist/types/init-options.d.mts

@@ -236,7 +236,7 @@ type BetterAuthAdvancedOptions = {
      * @example ["x-client-ip", "x-forwarded-for", "cf-connecting-ip"]
      *
      * @default
-     * @link https://github.com/better-auth/better-auth/blob/main/packages/better-auth/src/utils/get-request-ip.ts#L8
+     * @link https://github.com/better-auth/better-auth/blob/main/packages/core/src/utils/ip.ts
      */
     ipAddressHeaders?: string[];
     /**
@@ -253,6 +253,21 @@ type BetterAuthAdvancedOptions = {
      * @default 64
      */
     ipv6Subnet?: number;
+    /**
+     * Trusted reverse-proxy IPs or CIDR ranges. When set, a forwarded IP
+     * chain is walked right to left, trusted hops are skipped, and the
+     * first untrusted address is the client IP. Unset trusts only
+     * single-value IP headers. Use the actual address or subnet of your
+     * proxies, not a broad private range that also covers clients.
+     *
+     * This only interprets the forwarded header chain and cannot verify
+     * the direct sender. It is safe only when your origin is reachable
+     * through these proxies and clients cannot set forwarded headers
+     * directly.
+     *
+     * @example ["192.0.2.10", "10.0.0.0/24"]
+     */
+    trustedProxies?: string[];
   } | undefined;
   /**
    * Force cookies to always use the `Secure` attribute. By default,

package/dist/utils/ip.d.mts

@@ -1,3 +1,4 @@
+import { BetterAuthOptions } from "../types/init-options.mjs";
 //#region src/utils/ip.d.ts
 /**
  * Normalizes an IP address for consistent rate limiting.
@@ -42,6 +43,27 @@ declare function isValidIP(ip: string): boolean;
  * // -> "2001:0db8:0000:0000:0000:0000:0000:0000" (subnet /64)
  */
 declare function normalizeIP(ip: string, options?: NormalizeIPOptions): string;
+/**
+ * Trusted-proxy entries that are not a valid IP address or CIDR range.
+ */
+declare function findInvalidTrustedProxies(entries: string[]): string[];
+/**
+ * Resolves the client IP from a forwarded header. The leftmost token is spoofable,
+ * so with `trustedProxies` the chain is stripped from the right to the first
+ * untrusted hop. Otherwise only a single-value header is trusted. Returns `null`
+ * when no trustworthy client IP can be resolved.
+ */
+declare function getIPFromHeader(value: string, options?: {
+  ipv6Subnet?: number;
+  trustedProxies?: string[];
+}): string | null;
+/**
+ * Resolves the client IP for a request from the configured IP headers.
+ * Honors `disableIpTracking`, walks `ipAddressHeaders` in order (default
+ * `x-forwarded-for`), and falls back to localhost in development and test.
+ * Returns `null` when tracking is disabled or no trustworthy IP can be resolved.
+ */
+declare function getIP(req: Request | Headers, options: BetterAuthOptions): string | null;
 /**
  * Creates a rate limit key from IP and path
  * Uses a separator to prevent collision attacks
@@ -52,4 +74,4 @@ declare function normalizeIP(ip: string, options?: NormalizeIPOptions): string;
  */
 declare function createRateLimitKey(ip: string, path: string): string;
 //#endregion
-export { createRateLimitKey, isValidIP, normalizeIP };
+export { createRateLimitKey, findInvalidTrustedProxies, getIP, getIPFromHeader, isValidIP, normalizeIP };

package/dist/utils/ip.mjs

@@ -1,3 +1,4 @@
+import { isDevelopment, isTest } from "../env/env-impl.mjs";
 import * as z from "zod";
 //#region src/utils/ip.ts
 /**
@@ -102,6 +103,119 @@ function normalizeIP(ip, options = {}) {
 	return normalizeIPv6(ip, options.ipv6Subnet ?? 64);
 }
 /**
+* Raw bytes of an IP for CIDR comparison. Returns `null` for an invalid IP.
+*/
+function ipToBytes(ip) {
+	if (z.ipv4().safeParse(ip).success) return Uint8Array.from(ip.split(".").map((octet) => Number(octet)));
+	if (!isIPv6(ip)) return null;
+	const mapped = extractIPv4FromMapped(ip);
+	if (mapped) return Uint8Array.from(mapped.split(".").map((octet) => Number(octet)));
+	const groups = expandIPv6(ip);
+	const bytes = new Uint8Array(16);
+	for (let i = 0; i < 8; i++) {
+		const group = Number.parseInt(groups[i] ?? "0", 16);
+		bytes[i * 2] = group >> 8 & 255;
+		bytes[i * 2 + 1] = group & 255;
+	}
+	return bytes;
+}
+const CIDR_PREFIX_PATTERN = /^\d+$/;
+/**
+* Parses an IP or `IP/prefix` string into network bytes and a prefix length.
+* The prefix must be digits only and within the address family. `null` if the
+* value is not a valid IP or CIDR range, which keeps a malformed entry from
+* silently behaving like a non-match.
+*/
+function parseCIDR(value) {
+	const slash = value.lastIndexOf("/");
+	const bytes = ipToBytes(slash === -1 ? value : value.slice(0, slash));
+	if (!bytes) return null;
+	const maxBits = bytes.length * 8;
+	if (slash === -1) return {
+		bytes,
+		prefix: maxBits
+	};
+	const prefixPart = value.slice(slash + 1);
+	if (!CIDR_PREFIX_PATTERN.test(prefixPart)) return null;
+	const prefix = Number(prefixPart);
+	return prefix <= maxBits ? {
+		bytes,
+		prefix
+	} : null;
+}
+/**
+* Whether `ipBytes` falls inside an already-parsed CIDR network.
+*/
+function matchesCIDR(ipBytes, net) {
+	if (ipBytes.length !== net.bytes.length) return false;
+	let bitsRemaining = net.prefix;
+	for (let i = 0; i < ipBytes.length && bitsRemaining > 0; i++) {
+		const take = bitsRemaining >= 8 ? 8 : bitsRemaining;
+		const mask = take === 8 ? 255 : 255 << 8 - take & 255;
+		if (((ipBytes[i] ?? 0) & mask) !== ((net.bytes[i] ?? 0) & mask)) return false;
+		bitsRemaining -= 8;
+	}
+	return true;
+}
+/**
+* Trusted-proxy entries that are not a valid IP address or CIDR range.
+*/
+function findInvalidTrustedProxies(entries) {
+	return entries.filter((entry) => parseCIDR(entry) === null);
+}
+/**
+* Resolves the client IP from a forwarded header. The leftmost token is spoofable,
+* so with `trustedProxies` the chain is stripped from the right to the first
+* untrusted hop. Otherwise only a single-value header is trusted. Returns `null`
+* when no trustworthy client IP can be resolved.
+*/
+function getIPFromHeader(value, options = {}) {
+	const forwardedIps = value.split(",").map((ip) => ip.trim()).filter(Boolean);
+	if (forwardedIps.length === 0) return null;
+	const trustedProxies = (options.trustedProxies ?? []).map(parseCIDR).filter((proxy) => {
+		return proxy !== null;
+	});
+	if (trustedProxies.length > 0) {
+		for (let i = forwardedIps.length - 1; i >= 0; i--) {
+			const ip = forwardedIps[i];
+			const ipBytes = ip ? ipToBytes(ip) : null;
+			if (!ip || !ipBytes) return null;
+			if (trustedProxies.some((proxy) => matchesCIDR(ipBytes, proxy))) continue;
+			return normalizeIP(ip, { ipv6Subnet: options.ipv6Subnet });
+		}
+		return null;
+	}
+	if (forwardedIps.length !== 1) return null;
+	const selectedIp = forwardedIps[0];
+	if (!selectedIp || !isValidIP(selectedIp)) return null;
+	return normalizeIP(selectedIp, { ipv6Subnet: options.ipv6Subnet });
+}
+const LOCALHOST_IP = "127.0.0.1";
+const DEFAULT_IP_HEADERS = ["x-forwarded-for"];
+/**
+* Resolves the client IP for a request from the configured IP headers.
+* Honors `disableIpTracking`, walks `ipAddressHeaders` in order (default
+* `x-forwarded-for`), and falls back to localhost in development and test.
+* Returns `null` when tracking is disabled or no trustworthy IP can be resolved.
+*/
+function getIP(req, options) {
+	if (options.advanced?.ipAddress?.disableIpTracking) return null;
+	const headers = "headers" in req ? req.headers : req;
+	const ipHeaders = options.advanced?.ipAddress?.ipAddressHeaders || DEFAULT_IP_HEADERS;
+	for (const key of ipHeaders) {
+		const value = "get" in headers ? headers.get(key) : headers[key];
+		if (typeof value === "string") {
+			const ip = getIPFromHeader(value, {
+				ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet,
+				trustedProxies: options.advanced?.ipAddress?.trustedProxies
+			});
+			if (ip) return ip;
+		}
+	}
+	if (isTest() || isDevelopment()) return LOCALHOST_IP;
+	return null;
+}
+/**
 * Creates a rate limit key from IP and path
 * Uses a separator to prevent collision attacks
 *
@@ -113,4 +227,4 @@ function createRateLimitKey(ip, path) {
 	return `${ip}|${path}`;
 }
 //#endregion
-export { createRateLimitKey, isValidIP, normalizeIP };
+export { createRateLimitKey, findInvalidTrustedProxies, getIP, getIPFromHeader, isValidIP, normalizeIP };