@better-auth/core 1.7.0-rc.1 → 1.7.0-rc.3

package/src/social-providers/wechat.ts

@@ -59,6 +59,7 @@ export const wechat = (options: WeChatOptions) => {
 	return {
 		id: "wechat",
 		name: "WeChat",
+		accountSubject: ({ profile }) => profile.unionid || profile.openid,
 		createAuthorizationURL({ state, scopes, redirectURI, additionalParams }) {
 			const _scopes = options.disableDefaultScope ? [] : ["snsapi_login"];
 			options.scope && _scopes.push(...options.scope);
@@ -206,7 +207,6 @@ export const wechat = (options: WeChatOptions) => {
 			const userMap = await options.mapProfileToUser?.(profile);
 			return {
 				user: {
-					id: profile.unionid || profile.openid || openid,
 					name: profile.nickname,
 					// WeChat does not return an email, and the OAuth callback rejects a
 					// missing one, so the default sign-in would always fail. Synthesize a

package/src/social-providers/zoom.ts

@@ -152,6 +152,7 @@ export const zoom = (userOptions: ZoomOptions) => {
 	return {
 		id: "zoom",
 		name: "Zoom",
+		accountSubject: ({ profile }) => profile.id,
 		createAuthorizationURL: async ({
 			state,
 			redirectURI,
@@ -210,7 +211,6 @@ export const zoom = (userOptions: ZoomOptions) => {
 
 			return {
 				user: {
-					id: profile.id,
 					name: profile.display_name,
 					image: profile.pic_url,
 					email: profile.email,

package/src/types/context.ts

@@ -9,6 +9,7 @@ import type {
 	Verification,
 } from "../db";
 import type { DBAdapter, Where } from "../db/adapter";
+import type { AccountKey } from "../db/schema/account";
 import type { createLogger } from "../env";
 import type { OAuthProvider } from "../oauth2";
 import type { BetterAuthCookie, BetterAuthCookies } from "./cookie";
@@ -132,6 +133,9 @@ export interface InternalAdapter<
 		dontRememberMe?: boolean | undefined,
 		override?: (Partial<Session> & Record<string, any>) | undefined,
 		overrideAll?: boolean | undefined,
+		storageOptions?:
+			| { deferSecondaryStorageWrites?: boolean | undefined }
+			| undefined,
 	): Promise<Session>;
 
 	findSession(token: string): Promise<{
@@ -160,7 +164,7 @@ export interface InternalAdapter<
 	/**
 	 * Delete an account by its primary key.
 	 *
-	 * @param id - The account row's primary key (the `id` column, not the `accountId` column).
+	 * @param id - The account row's primary key, not its provider account ID.
 	 */
 	deleteAccount(id: string): Promise<void>;
 
@@ -174,15 +178,18 @@ export interface InternalAdapter<
 	 */
 	deleteSessions(sessionTokens: string[]): Promise<void>;
 
-	findOAuthUser(
-		email: string,
-		accountId: string,
-		providerId: string,
-	): Promise<{
-		user: User;
-		linkedAccount: Account | null;
-		accounts: Account[];
-	} | null>;
+	findAccountOwnerByKey(accountKey: AccountKey): Promise<
+		| {
+				kind: "owned";
+				user: User;
+				account: Account;
+		  }
+		| {
+				kind: "orphaned";
+				account: Account;
+		  }
+		| null
+	>;
 
 	findUserByEmail(
 		email: string,
@@ -210,10 +217,10 @@ export interface InternalAdapter<
 
 	findAccounts(userId: string): Promise<Account[]>;
 
-	findAccountByProviderId(
-		accountId: string,
-		providerId: string,
-	): Promise<Account | null>;
+	/** Find the credential account whose stable local subject is the user ID. */
+	findCredentialAccount(userId: string): Promise<Account | null>;
+
+	findAccountByKey(accountKey: AccountKey): Promise<Account | null>;
 
 	findAccountByUserId(userId: string): Promise<Account[]>;
 

package/src/types/init-options.ts

@@ -454,6 +454,21 @@ export type BetterAuthAdvancedOptions = {
 				 * function.
 				 */
 				generateId?: GenerateIdFn | false | "serial" | "uuid";
+				/**
+				 * Enable database joins for adapters that support them.
+				 *
+				 * When disabled (default), related data is fetched via
+				 * separate queries. When enabled, adapters that support
+				 * native joins use them; otherwise Better Auth falls back
+				 * to separate queries.
+				 *
+				 * Please read the adapter documentation for more
+				 * information regarding joins before enabling this.
+				 * Not all adapters support joins.
+				 *
+				 * @default false
+				 */
+				joins?: boolean;
 		  }
 		| undefined;
 	/**
@@ -1783,18 +1798,4 @@ export type BetterAuthOptions = {
 				debug?: boolean;
 		  }
 		| undefined;
-	/**
-	 * Experimental features
-	 */
-	experimental?: {
-		/**
-		 * Enable experimental joins for your database adapter.
-		 *
-		 * 	Please read the adapter documentation for more information regarding joins before enabling this.
-		 * 	Not all adapters support joins.
-		 *
-		 * @default false
-		 */
-		joins?: boolean;
-	};
 };

package/src/utils/redirect-uri.ts

@@ -2,6 +2,26 @@ import * as z from "zod";
 import { isLoopbackHost } from "./host";
 import { DANGEROUS_URL_SCHEMES } from "./url";
 
+const REVERSE_DOMAIN_PRIVATE_USE_SCHEME =
+	/^[a-z](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/i;
+
+/**
+ * Returns whether a parsed redirect URI uses an authority-free, reverse-domain
+ * private-use scheme as recommended by RFC 8252 §7.1.
+ */
+export function isReverseDomainPrivateUseRedirectUri(uri: URL): boolean {
+	const scheme = uri.protocol.slice(0, -1);
+	const schemeSpecificPart = uri.href.slice(uri.protocol.length);
+	return (
+		uri.protocol !== "http:" &&
+		uri.protocol !== "https:" &&
+		uri.host.length === 0 &&
+		schemeSpecificPart.startsWith("/") &&
+		!schemeSpecificPart.startsWith("//") &&
+		REVERSE_DOMAIN_PRIVATE_USE_SCHEME.test(scheme)
+	);
+}
+
 /**
  * Zod schema for OAuth redirect URIs and other developer-supplied URLs that the
  * server stores and later hands back to a browser.