@better-auth/core 1.7.0-rc.1 → 1.7.0-rc.3

package/src/social-providers/facebook.ts

@@ -9,7 +9,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
-export interface FacebookProfile {
+export interface FacebookGraphProfile {
 	id: string;
 	name: string;
 	email?: string;
@@ -24,6 +24,17 @@ export interface FacebookProfile {
 	};
 }
 
+export interface FacebookLimitedLoginProfile {
+	sub: string;
+	email: string;
+	name: string;
+	picture: string;
+}
+
+export type FacebookProfile =
+	| FacebookGraphProfile
+	| FacebookLimitedLoginProfile;
+
 interface FacebookDebugTokenData {
 	app_id?: string;
 	is_valid?: boolean;
@@ -95,6 +106,9 @@ export const facebook = (options: FacebookOptions) => {
 	return {
 		id: "facebook",
 		name: "Facebook",
+		accountSubject: ({ profile }) =>
+			"sub" in profile ? profile.sub : profile.id,
+		accountIssuer: "https://www.facebook.com",
 		async createAuthorizationURL({
 			state,
 			scopes,
@@ -167,38 +181,18 @@ export const facebook = (options: FacebookOptions) => {
 			}
 
 			if (token.idToken && token.idToken.split(".").length === 3) {
-				const profile = decodeJwt(token.idToken) as {
-					sub: string;
-					email: string;
-					name: string;
-					picture: string;
-				};
-
-				const user = {
-					id: profile.sub,
-					name: profile.name,
-					email: profile.email,
-					picture: {
-						data: {
-							url: profile.picture,
-							height: 100,
-							width: 100,
-							is_silhouette: false,
-						},
-					},
-				};
+				const profile = decodeJwt(token.idToken) as FacebookLimitedLoginProfile;
 
 				// https://developers.facebook.com/docs/facebook-login/limited-login/permissions
 				// Facebook ID token does not include email_verified claim.
 				// We default to false for security consistency.
-				const userMap = await options.mapProfileToUser?.({
-					...user,
-					email_verified: false,
-				});
+				const userMap = await options.mapProfileToUser?.(profile);
 
 				return {
 					user: {
-						...user,
+						name: profile.name,
+						email: profile.email,
+						image: profile.picture,
 						emailVerified: false,
 						...userMap,
 					},
@@ -228,7 +222,7 @@ export const facebook = (options: FacebookOptions) => {
 				"picture",
 				...(options?.fields || []),
 			];
-			const { data: profile, error } = await betterFetch<FacebookProfile>(
+			const { data: profile, error } = await betterFetch<FacebookGraphProfile>(
 				"https://graph.facebook.com/me?fields=" + fields.join(","),
 				{
 					auth: {
@@ -247,7 +241,6 @@ export const facebook = (options: FacebookOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.id,
 					name: profile.name,
 					email: profile.email,
 					image: profile.picture.data.url,

package/src/social-providers/figma.ts

@@ -24,6 +24,7 @@ export const figma = (options: FigmaOptions) => {
 	return {
 		id: "figma",
 		name: "Figma",
+		accountSubject: ({ profile }) => profile.id,
 		async createAuthorizationURL({
 			state,
 			scopes,
@@ -106,7 +107,6 @@ export const figma = (options: FigmaOptions) => {
 
 				return {
 					user: {
-						id: profile.id,
 						name: profile.handle,
 						email: profile.email,
 						image: profile.img_url,

package/src/social-providers/github.ts

@@ -63,6 +63,7 @@ export const github = (options: GithubOptions) => {
 	return {
 		id: "github",
 		name: "GitHub",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -171,7 +172,6 @@ export const github = (options: GithubOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.id,
 					name: profile.name || profile.login || "",
 					email: profile.email,
 					image: profile.avatar_url,

package/src/social-providers/gitlab.ts

@@ -81,6 +81,7 @@ export const gitlab = (options: GitlabOptions) => {
 	return {
 		id: issuerId,
 		name: issuerName,
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL: async ({
 			state,
 			scopes,
@@ -142,7 +143,6 @@ export const gitlab = (options: GitlabOptions) => {
 			// We check for it first, then default to false for security consistency.
 			return {
 				user: {
-					id: profile.id,
 					name: profile.name ?? profile.username ?? "",
 					email: profile.email,
 					image: profile.avatar_url,

package/src/social-providers/google.ts

@@ -150,6 +150,8 @@ export const google = (options: GoogleOptions) => {
 	return {
 		id: "google",
 		name: "Google",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: "https://accounts.google.com",
 		async createAuthorizationURL({
 			state,
 			scopes,
@@ -254,7 +256,6 @@ export const google = (options: GoogleOptions) => {
 			const userMap = await options.mapProfileToUser?.(user);
 			return {
 				user: {
-					id: user.sub,
 					name: user.name,
 					email: user.email,
 					image: user.picture,

package/src/social-providers/huggingface.ts

@@ -47,6 +47,7 @@ export const huggingface = (options: HuggingFaceOptions) => {
 	return {
 		id: "huggingface",
 		name: "Hugging Face",
+		accountSubject: ({ profile }) => profile.sub,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -111,7 +112,6 @@ export const huggingface = (options: HuggingFaceOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.sub,
 					name: profile.name || profile.preferred_username || "",
 					email: profile.email,
 					image: profile.picture,

package/src/social-providers/kakao.ts

@@ -106,6 +106,7 @@ export const kakao = (options: KakaoOptions) => {
 	return {
 		id: "kakao",
 		name: "Kakao",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope
 				? []
@@ -162,7 +163,6 @@ export const kakao = (options: KakaoOptions) => {
 			const account = profile.kakao_account || {};
 			const kakaoProfile = account.profile || {};
 			const user = {
-				id: String(profile.id),
 				name: kakaoProfile.nickname || account.name || "",
 				email: account.email,
 				image:

package/src/social-providers/kick.ts

@@ -33,6 +33,7 @@ export const kick = (options: KickOptions) => {
 	return {
 		id: "kick",
 		name: "Kick",
+		accountSubject: ({ profile }) => profile.user_id,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -101,7 +102,6 @@ export const kick = (options: KickOptions) => {
 			// We default to false for security consistency.
 			return {
 				user: {
-					id: profile.user_id,
 					name: profile.name,
 					email: profile.email,
 					image: profile.profile_picture,

package/src/social-providers/line.ts

@@ -50,6 +50,8 @@ export const line = (options: LineOptions) => {
 	return {
 		id: "line",
 		name: "LINE",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: "https://access.line.me",
 		async createAuthorizationURL({
 			state,
 			scopes,
@@ -142,24 +144,17 @@ export const line = (options: LineOptions) => {
 				profile = data || null;
 			}
 			if (!profile) return null;
-			const userMap = await options.mapProfileToUser?.(profile as any);
-			// ID preference order
-			const id = (profile as any).sub || (profile as any).userId;
-			const name = (profile as any).name || (profile as any).displayName || "";
-			const image =
-				(profile as any).picture || (profile as any).pictureUrl || undefined;
-			const email = (profile as any).email;
+			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id,
-					name,
-					email,
-					image,
+					name: profile.name || "",
+					email: profile.email,
+					image: profile.picture,
 					// LINE does not expose email verification status in ID token/userinfo
 					emailVerified: false,
 					...userMap,
 				},
-				data: profile as any,
+				data: profile,
 			};
 		},
 		options,

package/src/social-providers/linear.ts

@@ -31,6 +31,7 @@ export const linear = (options: LinearOptions) => {
 	return {
 		id: "linear",
 		name: "Linear",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -113,7 +114,6 @@ export const linear = (options: LinearOptions) => {
 			// We default to false for security consistency.
 			return {
 				user: {
-					id: profile.data.viewer.id,
 					name: profile.data.viewer.name,
 					email: profile.data.viewer.email,
 					image: profile.data.viewer.avatarUrl,

package/src/social-providers/linkedin.ts

@@ -32,6 +32,7 @@ export const linkedin = (options: LinkedInOptions) => {
 	return {
 		id: "linkedin",
 		name: "Linkedin",
+		accountSubject: ({ profile }) => profile.sub,
 		createAuthorizationURL: async ({
 			state,
 			scopes,
@@ -97,7 +98,6 @@ export const linkedin = (options: LinkedInOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.sub,
 					name: profile.name,
 					email: profile.email,
 					emailVerified: profile.email_verified ?? false,

package/src/social-providers/microsoft-entra-id.ts

@@ -187,6 +187,8 @@ export const microsoft = (options: MicrosoftOptions) => {
 	return {
 		id: "microsoft",
 		name: "Microsoft EntraID",
+		accountSubject: ({ profile }) => profile.oid,
+		accountIssuer: ({ profile }) => profile.iss,
 		createAuthorizationURL(data) {
 			// Microsoft Entra supports public clients (SPA / native apps with
 			// PKCE only), so clientSecret is intentionally not required here.
@@ -277,33 +279,41 @@ export const microsoft = (options: MicrosoftOptions) => {
 				return null;
 			}
 			const user = decodeJwt(token.idToken) as MicrosoftEntraIDProfile;
+			if (typeof user.oid !== "string" || user.oid.trim().length === 0) {
+				logger.error(
+					"Microsoft Entra ID token did not include a valid oid claim; unable to resolve a stable account identifier.",
+				);
+				return null;
+			}
 			const profilePhotoSize = options.profilePhotoSize || 48;
-			await betterFetch<ArrayBuffer>(
-				`https://graph.microsoft.com/v1.0/me/photos/${profilePhotoSize}x${profilePhotoSize}/$value`,
-				{
-					headers: {
-						Authorization: `Bearer ${token.accessToken}`,
-					},
-					async onResponse(context) {
-						if (options.disableProfilePhoto || !context.response.ok) {
-							return;
-						}
-						try {
-							const response = context.response.clone();
-							const pictureBuffer = await response.arrayBuffer();
-							const pictureBase64 = base64.encode(pictureBuffer);
-							user.picture = `data:image/jpeg;base64, ${pictureBase64}`;
-						} catch (e) {
-							logger.error(
-								e && typeof e === "object" && "name" in e
-									? (e.name as string)
-									: "",
-								e,
-							);
-						}
+			if (!options.disableProfilePhoto && token.accessToken) {
+				await betterFetch<ArrayBuffer>(
+					`https://graph.microsoft.com/v1.0/me/photos/${profilePhotoSize}x${profilePhotoSize}/$value`,
+					{
+						headers: {
+							Authorization: `Bearer ${token.accessToken}`,
+						},
+						async onResponse(context) {
+							if (!context.response.ok) {
+								return;
+							}
+							try {
+								const response = context.response.clone();
+								const pictureBuffer = await response.arrayBuffer();
+								const pictureBase64 = base64.encode(pictureBuffer);
+								user.picture = `data:image/jpeg;base64, ${pictureBase64}`;
+							} catch (e) {
+								logger.error(
+									e && typeof e === "object" && "name" in e
+										? (e.name as string)
+										: "",
+									e,
+								);
+							}
+						},
 					},
-				},
-			);
+				);
+			}
 			const userMap = await options.mapProfileToUser?.(user);
 			// Microsoft Entra ID does NOT include email_verified claim by default.
 			// It must be configured as an optional claim in the app registration.
@@ -319,7 +329,6 @@ export const microsoft = (options: MicrosoftOptions) => {
 						: false;
 			return {
 				user: {
-					id: user.sub,
 					name: user.name,
 					email: user.email,
 					image: user.picture,
@@ -351,7 +360,7 @@ export const microsoft = (options: MicrosoftOptions) => {
 					});
 				},
 		options,
-	} satisfies OAuthProvider;
+	} satisfies OAuthProvider<MicrosoftEntraIDProfile>;
 };
 
 export const getMicrosoftPublicKey = async (

package/src/social-providers/naver.ts

@@ -44,6 +44,7 @@ export const naver = (options: NaverOptions) => {
 	return {
 		id: "naver",
 		name: "Naver",
+		accountSubject: ({ profile }) => profile.response.id,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["profile", "email"];
 			if (options.scope) _scopes.push(...options.scope);
@@ -97,7 +98,6 @@ export const naver = (options: NaverOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			const res = profile.response || {};
 			const user = {
-				id: res.id,
 				name: res.name || res.nickname || "",
 				email: res.email,
 				image: res.profile_image,

package/src/social-providers/notion.ts

@@ -28,6 +28,7 @@ export const notion = (options: NotionOptions) => {
 	return {
 		id: "notion",
 		name: "Notion",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -100,7 +101,6 @@ export const notion = (options: NotionOptions) => {
 			const userMap = await options.mapProfileToUser?.(userProfile);
 			return {
 				user: {
-					id: userProfile.id,
 					name: userProfile.name || "",
 					email: userProfile.person?.email || null,
 					image: userProfile.avatar_url,

package/src/social-providers/paybin.ts

@@ -36,6 +36,8 @@ export const paybin = (options: PaybinOptions) => {
 	return {
 		id: "paybin",
 		name: "Paybin",
+		accountSubject: ({ profile }) => profile.sub,
+		accountIssuer: issuer,
 		async createAuthorizationURL({
 			state,
 			scopes,
@@ -105,7 +107,6 @@ export const paybin = (options: PaybinOptions) => {
 			const userMap = await options.mapProfileToUser?.(user);
 			return {
 				user: {
-					id: user.sub,
 					name: user.name || user.preferred_username || "",
 					email: user.email,
 					image: user.picture,

package/src/social-providers/paypal.ts

@@ -79,6 +79,7 @@ export const paypal = (options: PayPalOptions) => {
 	return {
 		id: "paypal",
 		name: "PayPal",
+		accountSubject: ({ profile }) => profile.user_id,
 		async createAuthorizationURL({
 			state,
 			codeVerifier,
@@ -252,7 +253,6 @@ export const paypal = (options: PayPalOptions) => {
 
 				const result = {
 					user: {
-						id: userInfo.user_id,
 						name: userInfo.name,
 						email: userInfo.email,
 						image: userInfo.picture,

package/src/social-providers/polar.ts

@@ -37,6 +37,7 @@ export const polar = (options: PolarOptions) => {
 	return {
 		id: "polar",
 		name: "Polar",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -103,7 +104,6 @@ export const polar = (options: PolarOptions) => {
 			// We check for it first, then default to false for security consistency.
 			return {
 				user: {
-					id: profile.id,
 					name: profile.public_name || profile.username || "",
 					email: profile.email,
 					image: profile.avatar_url,

package/src/social-providers/railway.ts

@@ -29,6 +29,7 @@ export const railway = (options: RailwayOptions) => {
 	return {
 		id: "railway",
 		name: "Railway",
+		accountSubject: ({ profile }) => profile.sub,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -92,7 +93,6 @@ export const railway = (options: RailwayOptions) => {
 			// We default to false for security consistency.
 			return {
 				user: {
-					id: profile.sub,
 					name: profile.name,
 					email: profile.email,
 					image: profile.picture,

package/src/social-providers/reddit.ts

@@ -25,6 +25,7 @@ export const reddit = (options: RedditOptions) => {
 	return {
 		id: "reddit",
 		name: "Reddit",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["identity"];
 			if (options.scope) _scopes.push(...options.scope);
@@ -112,7 +113,6 @@ export const reddit = (options: RedditOptions) => {
 			const email = userMap?.email || `${profile.id}@reddit.invalid`;
 			return {
 				user: {
-					id: profile.id,
 					name: profile.name,
 					image: profile.icon_img?.split("?")[0]!,
 					...userMap,

package/src/social-providers/roblox.ts

@@ -41,6 +41,7 @@ export const roblox = (options: RobloxOptions) => {
 	return {
 		id: "roblox",
 		name: "Roblox",
+		accountSubject: ({ profile }) => profile.sub,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["openid", "profile"];
 			if (options.scope) _scopes.push(...options.scope);
@@ -100,7 +101,6 @@ export const roblox = (options: RobloxOptions) => {
 			// We default to false for security consistency.
 			return {
 				user: {
-					id: profile.sub,
 					name: profile.nickname || profile.preferred_username || "",
 					image: profile.picture,
 					email: profile.preferred_username || null, // Roblox does not provide email

package/src/social-providers/salesforce.ts

@@ -63,6 +63,7 @@ export const salesforce = (options: SalesforceOptions) => {
 	return {
 		id: "salesforce",
 		name: "Salesforce",
+		accountSubject: ({ profile }) => profile.user_id,
 
 		async createAuthorizationURL({
 			state,
@@ -146,7 +147,6 @@ export const salesforce = (options: SalesforceOptions) => {
 
 				return {
 					user: {
-						id: user.user_id,
 						name: user.name,
 						email: user.email,
 						image: user.photos?.picture || user.photos?.thumbnail,

package/src/social-providers/slack.ts

@@ -46,6 +46,7 @@ export const slack = (options: SlackOptions) => {
 	return {
 		id: "slack",
 		name: "Slack",
+		accountSubject: ({ profile }) => profile["https://slack.com/user_id"],
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope
 				? []
@@ -103,7 +104,6 @@ export const slack = (options: SlackOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile["https://slack.com/user_id"],
 					name: profile.name || "",
 					email: profile.email,
 					emailVerified: profile.email_verified,

package/src/social-providers/spotify.ts

@@ -24,6 +24,7 @@ export const spotify = (options: SpotifyOptions) => {
 	return {
 		id: "spotify",
 		name: "Spotify",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -86,7 +87,6 @@ export const spotify = (options: SpotifyOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.id,
 					name: profile.display_name,
 					email: profile.email,
 					image: profile.images[0]?.url,

package/src/social-providers/tiktok.ts

@@ -123,7 +123,7 @@ export interface TiktokProfile extends Record<string, any> {
 		| undefined;
 }
 
-export interface TiktokOptions extends ProviderOptions {
+export interface TiktokOptions extends ProviderOptions<TiktokProfile> {
 	// Client ID is not used in TikTok, we delete it from the options
 	clientId?: never | undefined;
 	clientSecret: string;
@@ -135,6 +135,7 @@ export const tiktok = (options: TiktokOptions) => {
 	return {
 		id: "tiktok",
 		name: "TikTok",
+		accountSubject: ({ profile }) => profile.data.user.open_id,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["user.info.profile"];
 			if (options.scope) _scopes.push(...options.scope);
@@ -210,7 +211,6 @@ export const tiktok = (options: TiktokOptions) => {
 			return {
 				user: {
 					email: profile.data.user.email || profile.data.user.username,
-					id: profile.data.user.open_id,
 					name:
 						profile.data.user.display_name || profile.data.user.username || "",
 					image: profile.data.user.avatar_large_url,

package/src/social-providers/twitch.ts

@@ -42,6 +42,7 @@ export const twitch = (options: TwitchOptions) => {
 	return {
 		id: "twitch",
 		name: "Twitch",
+		accountSubject: ({ profile }) => profile.sub,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope
 				? []
@@ -98,7 +99,6 @@ export const twitch = (options: TwitchOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.sub,
 					name: profile.preferred_username,
 					email: profile.email,
 					image: profile.picture,

package/src/social-providers/twitter.ts

@@ -108,6 +108,7 @@ export const twitter = (options: TwitterOption) => {
 	return {
 		id: "twitter",
 		name: "Twitter",
+		accountSubject: ({ profile }) => profile.data.id,
 		createAuthorizationURL(data) {
 			const _scopes = options.disableDefaultScope
 				? []
@@ -185,7 +186,6 @@ export const twitter = (options: TwitterOption) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.data.id,
 					name: profile.data.name,
 					email: profile.data.email || profile.data.username || null,
 					image: profile.data.profile_image_url,

package/src/social-providers/vercel.ts

@@ -20,6 +20,7 @@ export const vercel = (options: VercelOptions) => {
 	return {
 		id: "vercel",
 		name: "Vercel",
+		accountSubject: ({ profile }) => profile.sub,
 		createAuthorizationURL({
 			state,
 			scopes,
@@ -79,7 +80,6 @@ export const vercel = (options: VercelOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.sub,
 					name: profile.name ?? profile.preferred_username ?? "",
 					email: profile.email,
 					image: profile.picture,

package/src/social-providers/vk.ts

@@ -20,7 +20,7 @@ export interface VkProfile {
 	};
 }
 
-export interface VkOption extends ProviderOptions {
+export interface VkOption extends ProviderOptions<VkProfile> {
 	clientId: string;
 	scheme?: ("light" | "dark") | undefined;
 }
@@ -30,6 +30,7 @@ export const vk = (options: VkOption) => {
 	return {
 		id: "vk",
 		name: "VK",
+		accountSubject: ({ profile }) => profile.user.user_id,
 		async createAuthorizationURL({
 			state,
 			scopes,
@@ -113,7 +114,6 @@ export const vk = (options: VkOption) => {
 
 			return {
 				user: {
-					id: profile.user.user_id,
 					first_name: profile.user.first_name,
 					last_name: profile.user.last_name,
 					email: profile.user.email,