@better-auth/infra 0.2.12 → 0.2.13

package/dist/index.d.mts

@@ -132,6 +132,7 @@ interface ImpossibleTravelResult {
   action?: "allow" | "challenge" | "block";
   challenged?: boolean;
   challenge?: string;
+  powVerified?: boolean;
   distance?: number;
   timeElapsedHours?: number;
   speedRequired?: number;
@@ -774,7 +775,7 @@ interface DashIdRow {
   id: string;
 }
 //#endregion
-//#region ../../node_modules/.bun/@better-auth+scim@1.6.11+25e6a1339d5195dd/node_modules/@better-auth/scim/dist/index.d.mts
+//#region ../../node_modules/.bun/@better-auth+scim@1.6.14+790dbc3a881c5018/node_modules/@better-auth/scim/dist/index.d.mts
 //#region src/types.d.ts
 interface SCIMProvider {
   id: string;

package/dist/index.mjs

@@ -1,10 +1,10 @@
 import { n as INFRA_API_URL, r as INFRA_KV_URL } from "./constants-CvriWQVc.mjs";
 import { n as createKV, t as createAPI } from "./fetch-DiAhoiKA.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
+import { getCurrentAuthContext } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger, parseState } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
-import { getCurrentAuthContext } from "@better-auth/core/context";
 import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -108,6 +108,7 @@ const routes = {
 	DASH_ROUTE: "/dash",
 	DASH_UPDATE_USER: "/dash/update-user",
 	DASH_REVOKE_SESSIONS_ALL: "/dash/sessions/revoke-all",
+	DASH_IMPERSONATE_USER: "/dash/impersonate-user",
 	DASH_BAN_USER: "/dash/ban-user",
 	DASH_UNBAN_USER: "/dash/unban-user",
 	ADMIN_ROUTE: "/admin",
@@ -425,7 +426,7 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSessionRevokedAll = (session, trigger, ctx, _location) => {
+	const trackSessionRevokedAll = (session, trigger, ctx, location) => {
 		const track = async () => {
 			const user = await getUserById(session.userId, ctx);
 			trackEvent({
@@ -438,7 +439,11 @@ const initSessionEvents = (tracker) => {
 					userEmail: user?.email ?? "unknown",
 					triggeredBy: trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
@@ -527,7 +532,7 @@ const initSessionEvents = (tracker) => {
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackEmailVerificationSent = (session, user, trigger, _ctx) => {
+	const trackEmailVerificationSent = (session, user, trigger, location) => {
 		trackEvent({
 			eventKey: session.userId,
 			eventType: EVENT_TYPES.EMAIL_VERIFICATION_SENT,
@@ -539,10 +544,14 @@ const initSessionEvents = (tracker) => {
 				sessionId: session.id,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackEmailSignInAttempt = (ctx, trigger) => {
+	const trackEmailSignInAttempt = (ctx, trigger, location) => {
 		const track = async () => {
 			const user = await getUserByEmail(ctx.body.email, ctx);
 			trackEvent({
@@ -556,12 +565,16 @@ const initSessionEvents = (tracker) => {
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: user?.id ?? trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSocialSignInAttempt = (ctx, trigger) => {
+	const trackSocialSignInAttempt = (ctx, trigger, location) => {
 		const track = async () => {
 			const user = await getUserByIdToken(ctx.body.provider, ctx.body.idToken, ctx);
 			trackEvent({
@@ -575,12 +588,16 @@ const initSessionEvents = (tracker) => {
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: user?.user.id ?? trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
 	};
-	const trackSocialSignInRedirectionAttempt = (ctx, trigger) => {
+	const trackSocialSignInRedirectionAttempt = (ctx, trigger, location) => {
 		const track = async () => {
 			const user = await getUserByAuthorizationCode(tryDecode(ctx.params?.id), ctx);
 			trackEvent({
@@ -594,7 +611,11 @@ const initSessionEvents = (tracker) => {
 					loginMethod: getLoginMethod(ctx),
 					triggeredBy: trigger.triggeredBy,
 					triggerContext: trigger.triggerContext
-				}
+				},
+				ipAddress: location?.ipAddress,
+				city: location?.city,
+				country: location?.country,
+				countryCode: location?.countryCode
 			});
 		};
 		ctx.context.runInBackground(track());
@@ -1241,7 +1262,7 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 				return "";
 			}
 		},
-		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null) {
+		async checkImpossibleTravel(userId, currentLocation, visitorId, ip = null, powSolution) {
 			if (!options.impossibleTravel?.enabled || !currentLocation) return null;
 			try {
 				const data = await $api("/security/impossible-travel", {
@@ -1251,7 +1272,8 @@ function createSecurityClient(conn, $api, options, onSecurityEvent) {
 						visitorId,
 						location: currentLocation,
 						ip,
-						config: options
+						config: options,
+						...powSolution ? { powSolution } : {}
 					}
 				});
 				if (data.isImpossible) {
@@ -2190,7 +2212,9 @@ const sentinel = (options) => {
 							const identification = ctx.context.identification;
 							if (session.userId && identification?.location && visitorId) {
 								recordCheck(ctx, "impossible_travel");
-								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip);
+								const powSolution = ctx.headers?.get?.("X-PoW-Solution") ?? null;
+								const travelCheck = await securityService.checkImpossibleTravel(session.userId, identification.location, visitorId, identification.ip, powSolution);
+								if (travelCheck?.powVerified) recordCheck(ctx, "pow_challenge");
 								if (travelCheck?.isImpossible) {
 									if (travelCheck.action === "block") {
 										setOutcome(ctx, "blocked", "impossible_travel", {
@@ -2399,7 +2423,7 @@ const sentinel = (options) => {
 //#region src/events/organization/events-invitation.ts
 const initInvitationEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationMemberInvited = (organization, invitation, inviter, trigger) => {
+	const trackOrganizationMemberInvited = (organization, invitation, inviter, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITED,
@@ -2417,10 +2441,14 @@ const initInvitationEvents = (tracker) => {
 				inviterEmail: inviter.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteAccepted = (organization, invitation, member, acceptedBy, trigger) => {
+	const trackOrganizationMemberInviteAccepted = (organization, invitation, member, acceptedBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_ACCEPTED,
@@ -2440,10 +2468,14 @@ const initInvitationEvents = (tracker) => {
 				memberRole: member.role,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteRejected = (organization, invitation, rejectedBy, trigger) => {
+	const trackOrganizationMemberInviteRejected = (organization, invitation, rejectedBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_REJECTED,
@@ -2461,10 +2493,14 @@ const initInvitationEvents = (tracker) => {
 				rejectedByName: rejectedBy.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberInviteCanceled = (organization, invitation, cancelledBy, trigger) => {
+	const trackOrganizationMemberInviteCanceled = (organization, invitation, cancelledBy, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_INVITE_CANCELED,
@@ -2482,7 +2518,11 @@ const initInvitationEvents = (tracker) => {
 				cancelledByEmail: cancelledBy.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2496,7 +2536,7 @@ const initInvitationEvents = (tracker) => {
 //#region src/events/organization/events-member.ts
 const initMemberEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationMemberAdded = (organization, member, user, trigger) => {
+	const trackOrganizationMemberAdded = (organization, member, user, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_ADDED,
@@ -2512,10 +2552,14 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberRemoved = (organization, member, user, trigger) => {
+	const trackOrganizationMemberRemoved = (organization, member, user, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_REMOVED,
@@ -2531,10 +2575,14 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationMemberRoleUpdated = (organization, member, user, previousRole, trigger) => {
+	const trackOrganizationMemberRoleUpdated = (organization, member, user, previousRole, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_MEMBER_ROLE_UPDATED,
@@ -2551,7 +2599,11 @@ const initMemberEvents = (tracker) => {
 				memberEmail: user.email ?? "unknown",
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2564,7 +2616,7 @@ const initMemberEvents = (tracker) => {
 //#region src/events/organization/events-organization.ts
 const initOrganizationEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationCreated = (organization, trigger) => {
+	const trackOrganizationCreated = (organization, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_CREATED,
@@ -2575,10 +2627,14 @@ const initOrganizationEvents = (tracker) => {
 				organizationName: organization.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationUpdated = (organization, trigger) => {
+	const trackOrganizationUpdated = (organization, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_UPDATED,
@@ -2589,7 +2645,11 @@ const initOrganizationEvents = (tracker) => {
 				organizationName: organization.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2601,7 +2661,7 @@ const initOrganizationEvents = (tracker) => {
 //#region src/events/organization/events-team.ts
 const initTeamEvents = (tracker) => {
 	const { trackEvent } = tracker;
-	const trackOrganizationTeamCreated = (organization, team, trigger) => {
+	const trackOrganizationTeamCreated = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_CREATED,
@@ -2614,10 +2674,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamUpdated = (organization, team, trigger) => {
+	const trackOrganizationTeamUpdated = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_UPDATED,
@@ -2630,10 +2694,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamDeleted = (organization, team, trigger) => {
+	const trackOrganizationTeamDeleted = (organization, team, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_DELETED,
@@ -2646,10 +2714,14 @@ const initTeamEvents = (tracker) => {
 				teamName: team.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamMemberAdded = (organization, team, user, teamMember, trigger) => {
+	const trackOrganizationTeamMemberAdded = (organization, team, user, teamMember, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_MEMBER_ADDED,
@@ -2664,10 +2736,14 @@ const initTeamEvents = (tracker) => {
 				memberName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
-	const trackOrganizationTeamMemberRemoved = (organization, team, user, teamMember, trigger) => {
+	const trackOrganizationTeamMemberRemoved = (organization, team, user, teamMember, trigger, location) => {
 		trackEvent({
 			eventKey: organization.id,
 			eventType: ORGANIZATION_EVENT_TYPES.ORGANIZATION_TEAM_MEMBER_REMOVED,
@@ -2682,7 +2758,11 @@ const initTeamEvents = (tracker) => {
 				memberName: user.name,
 				triggeredBy: trigger.triggeredBy,
 				triggerContext: trigger.triggerContext
-			}
+			},
+			ipAddress: location?.ipAddress,
+			city: location?.city,
+			country: location?.country,
+			countryCode: location?.countryCode
 		});
 	};
 	return {
@@ -2837,7 +2917,7 @@ const jwtValidateMiddleware = (options) => {
 };
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.12";
+const PLUGIN_VERSION = "0.2.13";
 //#endregion
 //#region src/routes/auth/config.ts
 const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
@@ -5717,7 +5797,7 @@ const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke
 }, async (ctx) => {
 	const { userId } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw ctx.error("NOT_FOUND", { message: "User not found" });
-	await ctx.context.internalAdapter.deleteSessions(userId);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
 	return ctx.json({ success: true });
 });
 const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revoke-many", {
@@ -5726,7 +5806,7 @@ const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revok
 }, async (ctx) => {
 	const { userIds } = ctx.context.payload;
 	await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
-		for (const userId of chunk) await ctx.context.internalAdapter.deleteSessions(userId);
+		for (const userId of chunk) await ctx.context.internalAdapter.deleteUserSessions(userId);
 	}, { concurrency: 3 });
 	return ctx.json({
 		success: true,
@@ -5848,39 +5928,41 @@ async function resolveHostnameAddresses(hostname) {
 		return null;
 	}
 }
-function validateUrlSync(rawUrl, options = {}) {
-	const trimmed = rawUrl.trim();
+function validateUrlSync(input, options = {}) {
 	let parsed;
-	try {
-		parsed = new URL(trimmed);
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid_url",
-			url: trimmed
-		};
+	if (input instanceof URL) parsed = input;
+	else {
+		const trimmed = input.trim();
+		try {
+			parsed = new URL(trimmed);
+		} catch {
+			return {
+				ok: false,
+				reason: "invalid_url"
+			};
+		}
 	}
 	if (!isAllowedProtocol(parsed.protocol, options.allowedProtocols)) return {
 		ok: false,
 		reason: "disallowed_protocol",
-		url: trimmed,
+		url: parsed,
 		protocol: parsed.protocol
 	};
 	if (parsed.username !== "" || parsed.password !== "") return {
 		ok: false,
 		reason: "embedded_credentials",
-		url: trimmed
+		url: parsed
 	};
 	if (isPrivateHost(parsed.hostname)) return {
 		ok: false,
 		reason: "private_host",
-		url: trimmed
+		url: parsed
 	};
 	if (options.allowedOrigins?.length) {
 		if (!isAllowedOrigin(parsed.origin, options.allowedOrigins)) return {
 			ok: false,
 			reason: "disallowed_origin",
-			url: trimmed,
+			url: parsed,
 			hostname: parsed.hostname,
 			origin: parsed.origin
 		};
@@ -5891,8 +5973,8 @@ function validateUrlSync(rawUrl, options = {}) {
 	};
 }
 /** SSRF checks with DNS resolution when available. */
-async function validateUrl(rawUrl, options = {}) {
-	const sync = validateUrlSync(rawUrl, options);
+async function validateUrl(input, options = {}) {
+	const sync = validateUrlSync(input, options);
 	if (!sync.ok) return sync;
 	if (options.dns === false) return sync;
 	const hostname = sync.url.hostname;
@@ -5900,19 +5982,23 @@ async function validateUrl(rawUrl, options = {}) {
 	if (!isIpLiteralHostname(hostname) && !addresses?.length) return {
 		ok: false,
 		reason: "unresolved_host",
-		url: sync.url.href,
+		url: sync.url,
 		hostname
 	};
 	if (addresses) {
 		for (const addr of addresses) if (isPrivateHost(addr)) return {
 			ok: false,
 			reason: "private_dns",
-			url: sync.url.href,
+			url: sync.url,
 			hostname,
 			address: addr
 		};
 	}
-	return sync;
+	return {
+		ok: true,
+		url: sync.url,
+		...addresses ? { addresses } : {}
+	};
 }
 function safeResolveUrl(raw, baseURL) {
 	const trim = raw.trim();
@@ -5928,12 +6014,6 @@ function safeResolveUrl(raw, baseURL) {
 }
 //#endregion
 //#region src/validation/ssrf.ts
-/**
-* SSRF protection for dash plugin outbound fetches.
-*
-* Uses @infra/utils at build time; tsdown bundles it into published dist so
-* consumers do not install the private workspace package.
-*/
 const REDIRECT_STATUSES = new Set([
 	301,
 	302,
@@ -5948,11 +6028,6 @@ var SsrfBlockedError = class extends Error {
 function isSsrfBlockedError(error) {
 	return error instanceof SsrfBlockedError;
 }
-/** Validates URL hostname literals and resolved DNS addresses. */
-async function parseAndValidateUrl(url) {
-	const result = await validateUrl(url);
-	return result.ok ? result.url : null;
-}
 /**
 * Fetch with SSRF checks on the initial URL and every redirect target.
 */
@@ -5960,8 +6035,9 @@ async function $outbound(url, options = {}) {
 	const { timeout, signal: callerSignal, ...fetchInit } = options;
 	let currentUrl = url;
 	for (let hop = 0;; hop++) {
-		const validated = await parseAndValidateUrl(currentUrl);
-		if (!validated) throw new SsrfBlockedError("Invalid or blocked URL");
+		const result = await validateUrl(currentUrl);
+		if (!result.ok) throw new SsrfBlockedError("Invalid or blocked URL");
+		const validated = result.url;
 		const signals = [];
 		if (callerSignal) signals.push(callerSignal);
 		if (timeout !== void 0 && timeout > 0) signals.push(AbortSignal.timeout(timeout));
@@ -5976,7 +6052,7 @@ async function $outbound(url, options = {}) {
 		const location = response.headers.get("location");
 		const next = location ? safeResolveUrl(location, validated.href) : null;
 		if (!next) throw new SsrfBlockedError("Invalid redirect location");
-		currentUrl = next.href;
+		currentUrl = next;
 	}
 }
 //#endregion
@@ -6091,23 +6167,19 @@ const oidcConfigSchema = z$1.object({
 });
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 	let idpMetadataXml = samlConfig.idpMetadata?.metadata;
-	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) {
-		const validatedMetadataUrl = await parseAndValidateUrl(samlConfig.idpMetadata.metadataUrl);
-		if (!validatedMetadataUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
-		try {
-			const metadataResponse = await $outbound(validatedMetadataUrl.href, {
-				method: "GET",
-				headers: { Accept: "application/xml, text/xml" },
-				timeout: 15e3
-			});
-			if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
-			idpMetadataXml = await metadataResponse.text();
-		} catch (e) {
-			if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
-			if (e instanceof APIError$1) throw e;
-			ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
-			throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
-		}
+	if (!idpMetadataXml && samlConfig.idpMetadata?.metadataUrl) try {
+		const metadataResponse = await $outbound(samlConfig.idpMetadata.metadataUrl, {
+			method: "GET",
+			headers: { Accept: "application/xml, text/xml" },
+			timeout: 15e3
+		});
+		if (!metadataResponse.ok) throw ctx.error("BAD_REQUEST", { message: `Failed to fetch IdP metadata from URL: ${metadataResponse.status} ${metadataResponse.statusText}` });
+		idpMetadataXml = await metadataResponse.text();
+	} catch (e) {
+		if (isSsrfBlockedError(e)) throw ctx.error("BAD_REQUEST", { message: "Invalid or blocked IdP metadata URL" });
+		if (e instanceof APIError$1) throw e;
+		ctx.context.logger.error("[Dash] Failed to fetch IdP metadata from URL:", e);
+		throw ctx.error("BAD_REQUEST", { message: "Failed to fetch IdP metadata from URL" });
 	}
 	const metadataAlgorithmWarnings = [];
 	if (idpMetadataXml) {
@@ -7651,7 +7723,7 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 		banExpires: banExpires ? new Date(banExpires) : null,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	await ctx.context.internalAdapter.deleteSessions(userId);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
 	return { success: true };
 });
 const banManyUsers = (options) => {
@@ -7981,6 +8053,13 @@ async function sendSMS(options, config) {
 }
 //#endregion
 //#region src/index.ts
+async function getRequestLocation() {
+	try {
+		return (await getCurrentAuthContext()).context.location;
+	} catch {
+		return;
+	}
+}
 const dash = (options) => {
 	const processedBulkOperationContexts = /* @__PURE__ */ new WeakSet();
 	const opts = resolveDashOptions(options);
@@ -8012,85 +8091,85 @@ const dash = (options) => {
 					const afterCreateOrganization = organizationHooks.afterCreateOrganization;
 					organizationHooks.afterCreateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user));
+						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterCreateOrganization) return afterCreateOrganization(...args);
 					};
 					const afterUpdateOrganization = organizationHooks.afterUpdateOrganization;
 					organizationHooks.afterUpdateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user));
+						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateOrganization) return afterUpdateOrganization(...args);
 					};
 					const afterAddMember = organizationHooks.afterAddMember;
 					organizationHooks.afterAddMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAddMember) return afterAddMember(...args);
 					};
 					const afterRemoveMember = organizationHooks.afterRemoveMember;
 					organizationHooks.afterRemoveMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRemoveMember) return afterRemoveMember(...args);
 					};
 					const afterUpdateMemberRole = organizationHooks.afterUpdateMemberRole;
 					organizationHooks.afterUpdateMemberRole = async (...args) => {
 						const [{ organization, member, user, previousRole }] = args;
-						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateMemberRole) return afterUpdateMemberRole(...args);
 					};
 					const afterCreateInvitation = organizationHooks.afterCreateInvitation;
 					organizationHooks.afterCreateInvitation = async (...args) => {
 						const [{ organization, invitation, inviter }] = args;
-						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter));
+						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter), await getRequestLocation());
 						if (afterCreateInvitation) return afterCreateInvitation(...args);
 					};
 					const afterAcceptInvitation = organizationHooks.afterAcceptInvitation;
 					organizationHooks.afterAcceptInvitation = async (...args) => {
 						const [{ organization, invitation, member, user }] = args;
-						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAcceptInvitation) return afterAcceptInvitation(...args);
 					};
 					const afterRejectInvitation = organizationHooks.afterRejectInvitation;
 					organizationHooks.afterRejectInvitation = async (...args) => {
 						const [{ organization, invitation, user }] = args;
-						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user));
+						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRejectInvitation) return afterRejectInvitation(...args);
 					};
 					const afterCancelInvitation = organizationHooks.afterCancelInvitation;
 					organizationHooks.afterCancelInvitation = async (...args) => {
 						const [{ organization, invitation, cancelledBy }] = args;
-						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy));
+						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy), await getRequestLocation());
 						if (afterCancelInvitation) return afterCancelInvitation(...args);
 					};
 					const afterCreateTeam = organizationHooks.afterCreateTeam;
 					organizationHooks.afterCreateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterCreateTeam) return afterCreateTeam(...args);
 					};
 					const afterUpdateTeam = organizationHooks.afterUpdateTeam;
 					organizationHooks.afterUpdateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user));
+						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterUpdateTeam) return afterUpdateTeam(...args);
 					};
 					const afterDeleteTeam = organizationHooks.afterDeleteTeam;
 					organizationHooks.afterDeleteTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterDeleteTeam) return afterDeleteTeam(...args);
 					};
 					const afterAddTeamMember = organizationHooks.afterAddTeamMember;
 					organizationHooks.afterAddTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterAddTeamMember) return afterAddTeamMember(...args);
 					};
 					const afterRemoveTeamMember = organizationHooks.afterRemoveTeamMember;
 					organizationHooks.afterRemoveTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user));
+						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
 						if (afterRemoveTeamMember) return afterRemoveTeamMember(...args);
 					};
 				};
@@ -8271,7 +8350,11 @@ const dash = (options) => {
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
 					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]);
+					return matchesAnyRoute(path, [
+						routes.SIGN_IN_SOCIAL_CALLBACK,
+						routes.SIGN_IN_OAUTH_CALLBACK,
+						routes.DASH_IMPERSONATE_USER
+					]);
 				},
 				handler: createIdentificationMiddleware($kv)
 			}],
@@ -8279,16 +8362,20 @@ const dash = (options) => {
 				matcher: (ctx) => {
 					if (ctx.request?.method !== "GET") return true;
 					const path = new URL(ctx.request.url).pathname;
-					return matchesAnyRoute(path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]);
+					return matchesAnyRoute(path, [
+						routes.SIGN_IN_SOCIAL_CALLBACK,
+						routes.SIGN_IN_OAUTH_CALLBACK,
+						routes.DASH_IMPERSONATE_USER
+					]);
 				},
 				handler: createAuthMiddleware(async (_ctx) => {
 					const ctx = _ctx;
 					const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
-					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx);
+					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
 					const body = ctx.body;
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
+					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK]) && ctx.request?.method === "GET" && ctx.context.returned instanceof Error && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
 					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
 					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
 						maxAge: 600,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",
@@ -61,13 +61,13 @@
   },
   "homepage": "https://better-auth.com",
   "devDependencies": {
-    "@better-auth/scim": "1.6.11",
-    "@better-auth/sso": "1.6.11",
+    "@better-auth/scim": "1.6.14",
+    "@better-auth/sso": "1.6.14",
     "@infra/mocks": "0.0.0",
     "@infra/utils": "0.0.0",
     "@types/bun": "latest",
     "@types/node": "^24.12.0",
-    "better-auth": "1.6.11",
+    "better-auth": "1.6.14",
     "expo-crypto": "^14.0.2",
     "happy-dom": "^20.9.0",
     "msw": "^2.14.6",