@better-auth/core 1.7.2 → 1.7.3

package/src/social-providers/paypal.ts

@@ -1,10 +1,17 @@
-import { base64 } from "@better-auth/utils/base64";
 import { betterFetch } from "@better-fetch/fetch";
 import { decodeJwt } from "jose";
 import { logger } from "../env";
 import { BetterAuthError } from "../error";
-import type { OAuthProvider, ProviderOptions } from "../oauth2";
-import { createAuthorizationURL } from "../oauth2";
+import type {
+	OAuthProvider,
+	ProviderOptions,
+	TokenEndpointAuth,
+} from "../oauth2";
+import {
+	createAuthorizationURL,
+	refreshAccessToken,
+	validateAuthorizationCode,
+} from "../oauth2";
 
 export interface PayPalProfile {
 	sub?: string | undefined;
@@ -75,6 +82,13 @@ export const paypal = (options: PayPalOptions) => {
 	const userInfoEndpoint = isSandbox
 		? "https://api-m.sandbox.paypal.com/v1/identity/oauth2/userinfo"
 		: "https://api-m.paypal.com/v1/identity/oauth2/userinfo";
+	const tokenRequestOptions = {
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+	};
+	const tokenEndpointAuth = {
+		method: "client_secret_basic",
+	} satisfies TokenEndpointAuth;
 
 	return {
 		id: "paypal",
@@ -115,47 +129,16 @@ export const paypal = (options: PayPalOptions) => {
 			return url;
 		},
 
-		validateAuthorizationCode: async ({ code, redirectURI }) => {
-			/**
-			 * PayPal requires Basic Auth for token exchange
-			 **/
-
-			const credentials = base64.encode(
-				`${options.clientId}:${options.clientSecret}`,
-			);
-
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
 			try {
-				const response = await betterFetch(tokenEndpoint, {
-					method: "POST",
-					headers: {
-						Authorization: `Basic ${credentials}`,
-						Accept: "application/json",
-						"Accept-Language": "en_US",
-						"Content-Type": "application/x-www-form-urlencoded",
-					},
-					body: new URLSearchParams({
-						grant_type: "authorization_code",
-						code: code,
-						redirect_uri: redirectURI,
-					}).toString(),
+				return await validateAuthorizationCode({
+					code,
+					codeVerifier,
+					redirectURI: options.redirectURI || redirectURI,
+					options: tokenRequestOptions,
+					tokenEndpoint,
+					tokenEndpointAuth,
 				});
-
-				if (!response.data) {
-					throw new BetterAuthError("FAILED_TO_GET_ACCESS_TOKEN");
-				}
-
-				const data = response.data as PayPalTokenResponse;
-
-				const result = {
-					accessToken: data.access_token,
-					refreshToken: data.refresh_token,
-					accessTokenExpiresAt: data.expires_in
-						? new Date(Date.now() + data.expires_in * 1000)
-						: undefined,
-					idToken: data.id_token,
-				};
-
-				return result;
 			} catch (error) {
 				logger.error("PayPal token exchange failed:", error);
 				throw new BetterAuthError("FAILED_TO_GET_ACCESS_TOKEN");
@@ -165,37 +148,13 @@ export const paypal = (options: PayPalOptions) => {
 		refreshAccessToken: options.refreshAccessToken
 			? options.refreshAccessToken
 			: async (refreshToken) => {
-					const credentials = base64.encode(
-						`${options.clientId}:${options.clientSecret}`,
-					);
-
 					try {
-						const response = await betterFetch(tokenEndpoint, {
-							method: "POST",
-							headers: {
-								Authorization: `Basic ${credentials}`,
-								Accept: "application/json",
-								"Accept-Language": "en_US",
-								"Content-Type": "application/x-www-form-urlencoded",
-							},
-							body: new URLSearchParams({
-								grant_type: "refresh_token",
-								refresh_token: refreshToken,
-							}).toString(),
+						return await refreshAccessToken({
+							refreshToken,
+							options: tokenRequestOptions,
+							tokenEndpoint,
+							tokenEndpointAuth,
 						});
-
-						if (!response.data) {
-							throw new BetterAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");
-						}
-
-						const data = response.data as any;
-						return {
-							accessToken: data.access_token,
-							refreshToken: data.refresh_token,
-							accessTokenExpiresAt: data.expires_in
-								? new Date(Date.now() + data.expires_in * 1000)
-								: undefined,
-						};
 					} catch (error) {
 						logger.error("PayPal token refresh failed:", error);
 						throw new BetterAuthError("FAILED_TO_REFRESH_ACCESS_TOKEN");

package/src/social-providers/reddit.ts

@@ -1,10 +1,13 @@
-import { base64 } from "@better-auth/utils/base64";
 import { betterFetch } from "@better-fetch/fetch";
-import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import type {
+	OAuthProvider,
+	ProviderOptions,
+	TokenEndpointAuth,
+} from "../oauth2";
 import {
 	createAuthorizationURL,
-	getOAuth2Tokens,
 	refreshAccessToken,
+	validateAuthorizationCode,
 } from "../oauth2";
 import { createPlaceholderEmail } from "../utils/email";
 
@@ -23,6 +26,15 @@ export interface RedditOptions extends ProviderOptions<RedditProfile> {
 }
 
 export const reddit = (options: RedditOptions) => {
+	const tokenEndpoint = "https://www.reddit.com/api/v1/access_token";
+	const tokenRequestOptions = {
+		clientId: options.clientId,
+		clientSecret: options.clientSecret,
+	};
+	const tokenEndpointAuth = {
+		method: "client_secret_basic",
+	} satisfies TokenEndpointAuth;
+
 	return {
 		id: "reddit",
 		name: "Reddit",
@@ -43,34 +55,17 @@ export const reddit = (options: RedditOptions) => {
 			});
 		},
 		validateAuthorizationCode: async ({ code, redirectURI }) => {
-			const body = new URLSearchParams({
-				grant_type: "authorization_code",
+			return validateAuthorizationCode({
 				code,
-				redirect_uri: options.redirectURI || redirectURI,
-			});
-			const headers = {
-				"content-type": "application/x-www-form-urlencoded",
-				accept: "text/plain",
-				"user-agent": "better-auth",
-				Authorization: `Basic ${base64.encode(
-					`${options.clientId}:${options.clientSecret}`,
-				)}`,
-			};
-
-			const { data, error } = await betterFetch<object>(
-				"https://www.reddit.com/api/v1/access_token",
-				{
-					method: "POST",
-					headers,
-					body: body.toString(),
+				redirectURI: options.redirectURI || redirectURI,
+				options: tokenRequestOptions,
+				tokenEndpoint,
+				tokenEndpointAuth,
+				headers: {
+					accept: "text/plain",
+					"user-agent": "better-auth",
 				},
-			);
-
-			if (error) {
-				throw error;
-			}
-
-			return getOAuth2Tokens(data);
+			});
 		},
 
 		refreshAccessToken: options.refreshAccessToken
@@ -78,13 +73,9 @@ export const reddit = (options: RedditOptions) => {
 			: async (refreshToken) => {
 					return refreshAccessToken({
 						refreshToken,
-						options: {
-							clientId: options.clientId,
-							clientKey: options.clientKey,
-							clientSecret: options.clientSecret,
-						},
-						authentication: "basic",
-						tokenEndpoint: "https://www.reddit.com/api/v1/access_token",
+						options: tokenRequestOptions,
+						tokenEndpoint,
+						tokenEndpointAuth,
 					});
 				},
 		async getUserInfo(token) {

package/src/social-providers/tiktok.ts

@@ -1,5 +1,9 @@
 import { betterFetch } from "@better-fetch/fetch";
-import type { OAuthProvider, ProviderOptions } from "../oauth2";
+import type {
+	OAuthProvider,
+	ProviderOptions,
+	TokenEndpointAuth,
+} from "../oauth2";
 import {
 	RESERVED_AUTHORIZATION_PARAMS_SET,
 	refreshAccessToken,
@@ -133,6 +137,13 @@ export interface TiktokOptions extends ProviderOptions<TiktokProfile> {
 
 export const tiktok = (options: TiktokOptions) => {
 	const tokenEndpoint = "https://open.tiktokapis.com/v2/oauth/token/";
+	const tokenEndpointAuth = {
+		method: "custom",
+		customizeRequest({ body }) {
+			body.set("client_key", options.clientKey);
+			body.set("client_secret", options.clientSecret);
+		},
+	} satisfies TokenEndpointAuth;
 	return {
 		id: "tiktok",
 		name: "TikTok",
@@ -159,15 +170,14 @@ export const tiktok = (options: TiktokOptions) => {
 			return url;
 		},
 
-		validateAuthorizationCode: async ({ code, redirectURI }) => {
+		validateAuthorizationCode: async ({ code, codeVerifier, redirectURI }) => {
 			return validateAuthorizationCode({
 				code,
+				codeVerifier,
 				redirectURI: options.redirectURI || redirectURI,
-				options: {
-					clientKey: options.clientKey,
-					clientSecret: options.clientSecret,
-				},
+				options: {},
 				tokenEndpoint,
+				tokenEndpointAuth,
 			});
 		},
 		refreshAccessToken: options.refreshAccessToken
@@ -175,14 +185,9 @@ export const tiktok = (options: TiktokOptions) => {
 			: async (refreshToken) => {
 					return refreshAccessToken({
 						refreshToken,
-						options: {
-							clientSecret: options.clientSecret,
-						},
+						options: {},
 						tokenEndpoint,
-						authentication: "post",
-						extraParams: {
-							client_key: options.clientKey,
-						},
+						tokenEndpointAuth,
 					});
 				},
 		async getUserInfo(token) {

package/src/types/context.ts

@@ -10,6 +10,7 @@ import type {
 } from "../db";
 import type { DBAdapter, Where } from "../db/adapter";
 import type { AccountKey } from "../db/schema/account";
+import type { SchemaCheck } from "../db/schema-check";
 import type { createLogger } from "../env";
 import type { OAuthProvider } from "../oauth2";
 import type {
@@ -417,6 +418,16 @@ export type AuthContext<Options extends BetterAuthOptions = BetterAuthOptions> =
 				"enabled" | "window" | "max" | "storage"
 			>;
 			adapter: DBAdapter<Options>;
+			/**
+			 * Confirms the database can hold what this configuration writes.
+			 *
+			 * Shared by initialization and requests for this adapter instance;
+			 * returns nothing once the schema is known to be clean.
+			 * Context construction does not await the verdict, so migration
+			 * tooling can still use a context whose schema needs repair.
+			 * Absent when the check is disabled or the adapter registers none.
+			 */
+			checkSchema?: SchemaCheck | undefined;
 			internalAdapter: InternalAdapter<Options>;
 			createAuthCookie: CreateCookieGetterFn;
 			secret: string;

package/src/types/init-options.ts

@@ -471,6 +471,17 @@ export type BetterAuthAdvancedOptions = {
 				 * @default false
 				 */
 				joins?: boolean;
+				/**
+				 * Validate the schema during initialization and report problems
+				 * through the configured logger. Authentication requests await
+				 * the same check and fail when the schema does not match.
+				 * Kysely introspects the database; Drizzle and Prisma inspect
+				 * local schema metadata without opening a connection.
+				 * Set `false` to disable runtime schema validation.
+				 *
+				 * @default true
+				 */
+				validateSchema?: boolean;
 		  }
 		| undefined;
 	/**

package/src/utils/ip.ts

@@ -2,6 +2,9 @@ import * as z from "zod";
 import { isDevelopment, isTest } from "../env";
 import type { BetterAuthOptions } from "../types";
 
+const ipv4Schema = z.ipv4();
+const ipv6Schema = z.ipv6();
+
 /**
  * Normalizes an IP address for consistent rate limiting.
  *
@@ -27,14 +30,15 @@ interface NormalizeIPOptions {
  * Checks if an IP is valid IPv4 or IPv6
  */
 export function isValidIP(ip: string): boolean {
-	return z.ipv4().safeParse(ip).success || z.ipv6().safeParse(ip).success;
+	return isIPv4(ip) || isIPv6(ip);
+}
+
+function isIPv4(ip: string): boolean {
+	return z.validate(ipv4Schema, ip);
 }
 
-/**
- * Checks if an IP is IPv6
- */
 function isIPv6(ip: string): boolean {
-	return z.ipv6().safeParse(ip).success;
+	return z.validate(ipv6Schema, ip);
 }
 
 /**
@@ -48,7 +52,7 @@ function extractIPv4FromMapped(ipv6: string): string | null {
 	if (lower.startsWith("::ffff:")) {
 		const ipv4Part = lower.substring(7);
 		// Check if it's a valid IPv4
-		if (z.ipv4().safeParse(ipv4Part).success) {
+		if (isIPv4(ipv4Part)) {
 			return ipv4Part;
 		}
 	}
@@ -57,7 +61,7 @@ function extractIPv4FromMapped(ipv6: string): string | null {
 	const parts = ipv6.split(":");
 	if (parts.length === 7 && parts[5]?.toLowerCase() === "ffff") {
 		const ipv4Part = parts[6];
-		if (ipv4Part && z.ipv4().safeParse(ipv4Part).success) {
+		if (ipv4Part && isIPv4(ipv4Part)) {
 			return ipv4Part;
 		}
 	}
@@ -176,7 +180,7 @@ export function normalizeIP(
 	options: NormalizeIPOptions = {},
 ): string {
 	// IPv4 addresses are already normalized
-	if (z.ipv4().safeParse(ip).success) {
+	if (isIPv4(ip)) {
 		return ip.toLowerCase();
 	}
 
@@ -201,7 +205,7 @@ export function normalizeIP(
  * Raw bytes of an IP for CIDR comparison. Returns `null` for an invalid IP.
  */
 function ipToBytes(ip: string): Uint8Array | null {
-	if (z.ipv4().safeParse(ip).success) {
+	if (isIPv4(ip)) {
 		return Uint8Array.from(ip.split(".").map((octet) => Number(octet)));
 	}
 	if (!isIPv6(ip)) {