@better-auth/core 1.7.1 → 1.7.3

package/src/social-providers/tiktok.ts

@@ -1,10 +1,15 @@
 import { betterFetch } from "@better-fetch/fetch";
-import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import type {
+	OAuthProvider,
+	ProviderOptions,
+	TokenEndpointAuth,
+} from "../oauth2";
 import {
 	RESERVED_AUTHORIZATION_PARAMS_SET,
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import { createPlaceholderEmail } from "../utils/email";
 
 /**
  * [More info](https://developers.tiktok.com/doc/tiktok-api-v2-get-user-info/)
@@ -132,6 +137,13 @@ export interface TiktokOptions extends ProviderOptions<TiktokProfile> {
 
 export const tiktok = (options: TiktokOptions) => {
 	const tokenEndpoint = "https://open.tiktokapis.com/v2/oauth/token/";
+	const tokenEndpointAuth = {
+		method: "custom",
+		customizeRequest({ body }) {
+			body.set("client_key", options.clientKey);
+			body.set("client_secret", options.clientSecret);
+		},
+	} satisfies TokenEndpointAuth;
 	return {
 		id: "tiktok",
 		name: "TikTok",
@@ -158,15 +170,14 @@ export const tiktok = (options: TiktokOptions) => {
 			return url;
 		},
 
-		validateAuthorizationCode: async ({ code, redirectURI }) => {
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
 			return validateAuthorizationCode({
 				code,
+				codeVerifier,
 				redirectURI: options.redirectURI || redirectURI,
-				options: {
-					clientKey: options.clientKey,
-					clientSecret: options.clientSecret,
-				},
+				options: {},
 				tokenEndpoint,
+				tokenEndpointAuth,
 			});
 		},
 		refreshAccessToken: options.refreshAccessToken
@@ -174,14 +185,9 @@ export const tiktok = (options: TiktokOptions) => {
 			: async (refreshToken) => {
 					return refreshAccessToken({
 						refreshToken,
-						options: {
-							clientSecret: options.clientSecret,
-						},
+						options: {},
 						tokenEndpoint,
-						authentication: "post",
-						extraParams: {
-							client_key: options.clientKey,
-						},
+						tokenEndpointAuth,
 					});
 				},
 		async getUserInfo(token) {
@@ -210,7 +216,12 @@ export const tiktok = (options: TiktokOptions) => {
 
 			return {
 				user: {
-					email: profile.data.user.email || profile.data.user.username,
+					email:
+						profile.data.user.email ||
+						createPlaceholderEmail({
+							identifier: profile.data.user.open_id,
+							namespace: "tiktok",
+						}),
 					name:
 						profile.data.user.display_name || profile.data.user.username || "",
 					image: profile.data.user.avatar_large_url,

package/src/social-providers/twitter.ts

@@ -5,6 +5,7 @@ import {
 	refreshAccessToken,
 	validateAuthorizationCode,
 } from "../oauth2";
+import { createPlaceholderEmail } from "../utils/email";
 
 export interface TwitterProfile {
 	data: {
@@ -187,9 +188,14 @@ export const twitter = (options: TwitterOption) => {
 			return {
 				user: {
 					name: profile.data.name,
-					email: profile.data.email || profile.data.username || null,
+					email:
+						profile.data.email ||
+						createPlaceholderEmail({
+							identifier: profile.data.id,
+							namespace: "twitter",
+						}),
 					image: profile.data.profile_image_url,
-					emailVerified: emailVerified,
+					emailVerified,
 					...userMap,
 				},
 				data: profile,

package/src/social-providers/wechat.ts

@@ -1,6 +1,7 @@
 import { betterFetch } from "@better-fetch/fetch";
 import type { OAuth2Tokens, OAuthProvider, ProviderOptions } from "../oauth2";
 import { RESERVED_AUTHORIZATION_PARAMS_SET } from "../oauth2";
+import { createPlaceholderEmail } from "../utils/email";
 
 /**
  * WeChat user profile information
@@ -205,17 +206,16 @@ export const wechat = (options: WeChatOptions) => {
 			}
 
 			const userMap = await options.mapProfileToUser?.(profile);
+			const userId = profile.unionid || profile.openid || openid;
 			return {
 				user: {
 					name: profile.nickname,
-					// WeChat does not return an email, and the OAuth callback rejects a
-					// missing one, so the default sign-in would always fail. Synthesize a
-					// stable, non-routable placeholder (RFC 2606 `.invalid`) keyed to the
-					// user's WeChat id, left unverified. Applications that collect a real
-					// email override it via `mapProfileToUser`.
 					email:
 						profile.email ||
-						`${profile.unionid || profile.openid || openid}@wechat.invalid`,
+						createPlaceholderEmail({
+							identifier: userId,
+							namespace: "wechat",
+						}),
 					image: profile.headimgurl,
 					emailVerified: false,
 					...userMap,

package/src/types/context.ts

@@ -10,6 +10,7 @@ import type {
 } from "../db";
 import type { DBAdapter, Where } from "../db/adapter";
 import type { AccountKey } from "../db/schema/account";
+import type { SchemaCheck } from "../db/schema-check";
 import type { createLogger } from "../env";
 import type { OAuthProvider } from "../oauth2";
 import type {
@@ -417,6 +418,16 @@ export type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> =
 				"enabled" | "window" | "max" | "storage"
 			>;
 			adapter: DBAdapter<Options>;
+			/**
+			 * Confirms the database can hold what this configuration writes.
+			 *
+			 * Shared by initialization and requests for this adapter instance;
+			 * returns nothing once the schema is known to be clean.
+			 * Context construction does not await the verdict, so migration
+			 * tooling can still use a context whose schema needs repair.
+			 * Absent when the check is disabled or the adapter registers none.
+			 */
+			checkSchema?: SchemaCheck | undefined;
 			internalAdapter: InternalAdapter<Options>;
 			createAuthCookie: CreateCookieGetterFn;
 			secret: string;

package/src/types/init-options.ts

@@ -471,6 +471,17 @@ export type BetterAuthAdvancedOptions = {
 				 * @default false
 				 */
 				joins?: boolean;
+				/**
+				 * Validate the schema during initialization and report problems
+				 * through the configured logger. Authentication requests await
+				 * the same check and fail when the schema does not match.
+				 * Kysely introspects the database; Drizzle and Prisma inspect
+				 * local schema metadata without opening a connection.
+				 * Set `false` to disable runtime schema validation.
+				 *
+				 * @default true
+				 */
+				validateSchema?: boolean;
 		  }
 		| undefined;
 	/**

package/src/utils/ip.ts

@@ -2,6 +2,9 @@ import * as z from "zod";
 import { isDevelopment, isTest } from "../env";
 import type { BetterAuthOptions } from "../types";
 
+const ipv4Schema = z.ipv4();
+const ipv6Schema = z.ipv6();
+
 /**
  * Normalizes an IP address for consistent rate limiting.
  *
@@ -27,14 +30,15 @@ interface NormalizeIPOptions {
  * Checks if an IP is valid IPv4 or IPv6
  */
 export function isValidIP(ip: string): boolean {
-	return z.ipv4().safeParse(ip).success || z.ipv6().safeParse(ip).success;
+	return isIPv4(ip) || isIPv6(ip);
+}
+
+function isIPv4(ip: string): boolean {
+	return z.validate(ipv4Schema, ip);
 }
 
-/**
- * Checks if an IP is IPv6
- */
 function isIPv6(ip: string): boolean {
-	return z.ipv6().safeParse(ip).success;
+	return z.validate(ipv6Schema, ip);
 }
 
 /**
@@ -48,7 +52,7 @@ function extractIPv4FromMapped(ipv6: string): string | null {
 	if (lower.startsWith("::ffff:")) {
 		const ipv4Part = lower.substring(7);
 		// Check if it's a valid IPv4
-		if (z.ipv4().safeParse(ipv4Part).success) {
+		if (isIPv4(ipv4Part)) {
 			return ipv4Part;
 		}
 	}
@@ -57,7 +61,7 @@ function extractIPv4FromMapped(ipv6: string): string | null {
 	const parts = ipv6.split(":");
 	if (parts.length === 7 && parts[5]?.toLowerCase() === "ffff") {
 		const ipv4Part = parts[6];
-		if (ipv4Part && z.ipv4().safeParse(ipv4Part).success) {
+		if (ipv4Part && isIPv4(ipv4Part)) {
 			return ipv4Part;
 		}
 	}
@@ -176,7 +180,7 @@ export function normalizeIP(
 	options: NormalizeIPOptions = {},
 ): string {
 	// IPv4 addresses are already normalized
-	if (z.ipv4().safeParse(ip).success) {
+	if (isIPv4(ip)) {
 		return ip.toLowerCase();
 	}
 
@@ -201,7 +205,7 @@ export function normalizeIP(
  * Raw bytes of an IP for CIDR comparison. Returns `null` for an invalid IP.
  */
 function ipToBytes(ip: string): Uint8Array | null {
-	if (z.ipv4().safeParse(ip).success) {
+	if (isIPv4(ip)) {
 		return Uint8Array.from(ip.split(".").map((octet) => Number(octet)));
 	}
 	if (!isIPv6(ip)) {

package/src/utils/url.ts

@@ -48,6 +48,49 @@ export function normalizePathname(
 	return pathname;
 }
 
+const URL_REFERENCE_ORIGIN = "https://better-auth.invalid";
+
+/**
+ * Appends query parameters before the fragment of an absolute or root-relative URL.
+ * Existing query text is retained without parsing it into name-value pairs.
+ *
+ * This function only composes URLs. Callers must validate untrusted input.
+ *
+ * @throws TypeError if parsing fails or a relative input changes authority.
+ */
+export function appendQueryParams(
+	input: string,
+	params: URLSearchParams,
+): string {
+	const relative = input.startsWith("/");
+	const hasAuthorityPrefix = input.startsWith("//") || input.startsWith("/\\");
+	if (hasAuthorityPrefix) {
+		throw new TypeError("Expected an absolute or root-relative URL");
+	}
+
+	const parsedURL = relative
+		? new URL(input, URL_REFERENCE_ORIGIN)
+		: new URL(input);
+
+	if (relative && parsedURL.origin !== URL_REFERENCE_ORIGIN) {
+		throw new TypeError("Expected an absolute or root-relative URL");
+	}
+
+	const query = params.toString();
+	if (!query) {
+		return input;
+	}
+
+	const separator = parsedURL.search.endsWith("&") ? "" : "&";
+	parsedURL.search = parsedURL.search
+		? `${parsedURL.search}${separator}${query}`
+		: query;
+
+	return relative
+		? parsedURL.href.slice(parsedURL.origin.length)
+		: parsedURL.href;
+}
+
 /**
  * Schemes that execute or embed code when navigated to or accepted as a
  * redirect target. These are never safe as an OAuth `redirect_uri` or as a