@better-auth/infra 0.2.14 → 0.3.1

package/CHANGELOG.md

@@ -5,6 +5,54 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.1] - 2026-06-22
+
+### Changed
+
+- **`dashClient` typing** — The client plugin now declares an explicit `BetterAuthClientPlugin` uses the updated signature, so `createAuthClient` inference works without casts when composing with other plugins.
+
+### Fixed
+
+- **Package metadata** — Repository and issue tracker URLs now point to `better-auth/infrastructure`.
+
+## [0.3.0] - 2026-06-19
+
+### Added
+
+- **Better Auth 1.7.x support** — SCIM directory sync works without the removed `providerOwnership` option; SSO dashboard routes no longer require `@better-auth/sso` as a separate peer dependency.
+- **Backwards compatibility for Better Auth 1.4–1.6** — Session deletion and session listing work across internal adapter API changes; secondary-storage sessions missing `id` are normalized for dashboard use.
+- **Expanded invitation auth modes** — Invitation acceptance supports `credential_setup`, `create_with_session`, and `create_no_session` in addition to `auth` and `direct`, aligned with the platform dashboard.
+- **`deleteAllSessions` on ban endpoints** — `banUser` and `banManyUsers` accept an optional `deleteAllSessions` flag (defaults to `true`); `banManyUsers` now revokes sessions for banned users.
+- **Strict user schemas** — Dashboard user create and update routes validate against schemas derived from the auth user table.
+
+### Changed
+
+- **Better Auth upgrade** — Compatibility target raised to Better Auth 1.7.x.
+- **Dash config redaction** — Plugin options and sensitive auth configuration use shared redaction utilities for more consistent masking.
+- **Client IP resolution** — Platform proxy headers are trusted by default; custom `ipAddressHeaders` must be configured explicitly.
+- **Sentinel security evaluation** — Security check events fall back to an untrusted visitor ID when trusted device identification is unavailable.
+- **Free-trial abuse prevention** — Uses atomic signup reservation and confirmation instead of a pre-create check.
+- **SMS client IP forwarding** — Outbound SMS requests can include the end-user IP via `x-better-auth-client-ip` for server-side abuse limits.
+
+### Fixed
+
+- **Generic OAuth callback events** — Failed sign-in events are tracked for generic OAuth2 callbacks (`/oauth2/callback/:providerId`).
+- **Event property typo** — Tracked failed sign-in events now use `userName` instead of `nameName`.
+- **Credential stuffing on reset-password** — Sentinel breached-password checks now run on the reset-password route.
+- **Sentinel identification** — Identify requests retry with exponential backoff, stale identification sessions expire and regenerate, and auth routes retry identification when the page-load attempt failed.
+- **Free-trial security checks** — Fixed race conditions on signup reservation and confirmation.
+- **Invitation scoping** — Cancel and resend invitation operations validate the invitation ID and scope queries to the authenticated organization.
+
+### Security
+
+- **Session tokens in dash responses** — Bearer tokens are stripped from dashboard user session listings.
+- **Credential stuffing fingerprints** — Failed-login password fingerprints use per-tenant HMAC-SHA256 instead of unsalted SHA-256.
+- **Identification for free-trial abuse** — Sign-up is blocked when free-trial abuse prevention is enabled but device identification is missing.
+- **Security check binding** — Sentinel security API calls include `requestId` for tighter operation binding.
+- **Redirect URL validation** — Dashboard and invitation routes validate callback and redirect URLs as safe `http(s)` URLs without embedded credentials.
+- **Organization slug validation** — Organization routes enforce comprehensive slug validation.
+- **User schema enforcement** — Dashboard user mutations are restricted to writable fields from the auth schema.
+
 ## [0.2.14] - 2026-06-09
 
 ### Added
@@ -37,5 +85,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Fixed impossible travel security challenges.
 
+[0.3.1]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.0...infra@v0.3.1
+[0.3.0]: https://github.com/better-auth/infrastructure/compare/infra@v0.2.14...infra@v0.3.0
 [0.2.14]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.13...@better-auth/infra@0.2.14
 [0.2.13]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.12...@better-auth/infra@0.2.13

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-CZzJyRrV.mjs";
+import { a as DashGetAuditLogsInput, i as DashGetAllAuditLogsInput, n as DashAuditLogsResponse, o as dashClient, r as DashClientOptions, t as DashAuditLog } from "./dash-client-CImS7uA_.mjs";
 
 //#region src/sentinel/client.d.ts
 interface SentinelClientOptions {

package/dist/client.mjs

@@ -1,6 +1,5 @@
-import "./constants-CLYqEwMV.mjs";
-import { n as createKV } from "./fetch-Bl0S3xUi.mjs";
-import { a as resolveSentinelClientIdentifyUrl, i as solvePoWChallenge, l as hash, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout, u as dashClient } from "./pow-retry-D2RRftJr.mjs";
+import { n as hash, o as createKV } from "./crypto-DuXBYsfj.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as dashClient, i as solvePoWChallenge, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout } from "./pow-retry-DyWb0par.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {
@@ -358,13 +357,23 @@ function calculateConfidence(components) {
 }
 let cachedFingerprint = null;
 let fingerprintPromise = null;
-let identifySent = false;
-let identifyCompletePromise = null;
-let identifyCompleteResolve = null;
+let identifySucceeded = false;
+let identifyExpiresAt = null;
+let identifyInFlight = null;
+function expireIdentifySessionIfStale() {
+	if (!identifySucceeded || identifyExpiresAt === null) return;
+	if (Date.now() < identifyExpiresAt) return;
+	identifySucceeded = false;
+	identifyExpiresAt = null;
+	if (cachedFingerprint) cachedFingerprint = {
+		...cachedFingerprint,
+		requestId: generateRequestId()
+	};
+}
 async function getFingerprint() {
 	if (typeof window === "undefined") return null;
-	if (await cachedFingerprint) return cachedFingerprint;
-	if (await fingerprintPromise) return fingerprintPromise;
+	if (cachedFingerprint) return cachedFingerprint;
+	if (fingerprintPromise !== null) return fingerprintPromise;
 	fingerprintPromise = (async () => {
 		const components = await collectFingerprint();
 		const visitorId = await generateVisitorId(components);
@@ -386,39 +395,39 @@ async function getFingerprint() {
 	}
 }
 async function sendIdentify($kv) {
-	if (identifySent || typeof window === "undefined") return;
-	const fingerprint = await getFingerprint();
-	if (!fingerprint) return;
-	identifySent = true;
-	identifyCompletePromise = new Promise((resolve) => {
-		identifyCompleteResolve = resolve;
-	});
-	const payload = {
-		visitorId: fingerprint.visitorId,
-		requestId: fingerprint.requestId,
-		confidence: fingerprint.confidence,
-		components: fingerprint.components,
-		url: window.location.href,
-		incognito: detectIncognito()
-	};
-	try {
-		await identify($kv, payload);
-	} catch (error) {
-		console.warn("[Dash] Identify request failed:", error);
-	} finally {
-		identifyCompleteResolve?.();
-	}
+	if (typeof window === "undefined") return identifySucceeded;
+	expireIdentifySessionIfStale();
+	if (identifySucceeded) return true;
+	if (identifyInFlight !== null) return identifyInFlight;
+	identifyInFlight = (async () => {
+		const fingerprint = await getFingerprint();
+		if (!fingerprint) return false;
+		const payload = {
+			visitorId: fingerprint.visitorId,
+			requestId: fingerprint.requestId,
+			confidence: fingerprint.confidence,
+			components: fingerprint.components,
+			url: window.location.href,
+			incognito: detectIncognito()
+		};
+		try {
+			const result = await identify($kv, payload);
+			identifySucceeded = true;
+			identifyExpiresAt = result.expiresAt ?? null;
+			return true;
+		} catch (error) {
+			console.warn("[Dash] Identify request failed:", error);
+			return false;
+		} finally {
+			identifyInFlight = null;
+		}
+	})();
+	return identifyInFlight;
 }
-/**
-* Wait for identify to complete, with a timeout
-* Returns immediately if identify hasn't started or has completed
-*
-* When `timeoutMs` is omitted or nullish, {@link KV_TIMEOUT_MS} is used.
-*/
-async function waitForIdentify(timeoutMs) {
-	if (!identifyCompletePromise) return;
-	const ms = timeoutMs ?? 1e3;
-	await Promise.race([identifyCompletePromise, new Promise((resolve) => setTimeout(resolve, ms))]);
+/** Append visitor id always; request id only after a successful identify POST. */
+function appendIdentification(headers, fingerprint) {
+	headers.set("X-Visitor-Id", fingerprint.visitorId);
+	if (identifySucceeded) headers.set("X-Request-Id", fingerprint.requestId);
 }
 //#endregion
 //#region src/sentinel/client.ts
@@ -432,6 +441,19 @@ const sentinelClient = (options) => {
 			envKvUrl: env.BETTER_AUTH_KV_URL
 		}),
 		kvTimeout: options?.kvTimeout
+	}, {
+		throw: true,
+		retry: {
+			type: "exponential",
+			attempts: 2,
+			baseDelay: 400,
+			maxDelay: 600,
+			shouldRetry(response) {
+				if (response === null) return true;
+				if (response.status === 429) return true;
+				return response.status >= 500;
+			}
+		}
 	});
 	if (typeof window !== "undefined") {
 		const scheduleIdentify = () => {
@@ -452,14 +474,11 @@ const sentinelClient = (options) => {
 			name: "sentinel-fingerprint",
 			hooks: { async onRequest(context) {
 				if (typeof window === "undefined") return context;
-				await waitForIdentify(options?.kvTimeout);
+				await sendIdentify($kv);
 				const fingerprint = await getFingerprint();
 				if (!fingerprint) return context;
 				const headers = context.headers || new Headers();
-				if (headers instanceof Headers) {
-					headers.set("X-Visitor-Id", fingerprint.visitorId);
-					headers.set("X-Request-Id", fingerprint.requestId);
-				}
+				if (headers instanceof Headers) appendIdentification(headers, fingerprint);
 				return {
 					...context,
 					headers
@@ -492,10 +511,7 @@ const sentinelClient = (options) => {
 							const fingerprint = await getFingerprint();
 							const retryHeaders = new Headers();
 							retryHeaders.set("X-PoW-Solution", encodePoWSolution(solution));
-							if (fingerprint) {
-								retryHeaders.set("X-Visitor-Id", fingerprint.visitorId);
-								retryHeaders.set("X-Request-Id", fingerprint.requestId);
-							}
+							if (fingerprint) appendIdentification(retryHeaders, fingerprint);
 							retryHeaders.set("Content-Type", "application/json");
 							const powRetry = createPowRetryTimeout(req.timeout);
 							try {

package/dist/{constants-CLYqEwMV.mjs → constants-Cjw_ECs7.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.2.14";
+const PLUGIN_VERSION = "0.3.1";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/crypto-DuXBYsfj.mjs

@@ -0,0 +1,51 @@
+import { i as INFRA_USER_AGENT } from "./constants-Cjw_ECs7.mjs";
+import { createFetch } from "@better-fetch/fetch";
+//#region src/fetch.ts
+function createAPI(options, fetchOptions) {
+	return createFetch({
+		baseURL: options.apiUrl,
+		headers: {
+			"user-agent": INFRA_USER_AGENT,
+			"x-api-key": options.apiKey
+		},
+		timeout: options.apiTimeout,
+		...fetchOptions
+	});
+}
+function createKV(options, fetchOptions) {
+	const headers = { "user-agent": INFRA_USER_AGENT };
+	if (options.apiKey) headers["x-api-key"] = options.apiKey;
+	return createFetch({
+		baseURL: options.kvUrl,
+		headers,
+		timeout: options.kvTimeout ?? 1e3,
+		...fetchOptions
+	});
+}
+//#endregion
+//#region src/crypto.ts
+function randomBytes(length) {
+	const bytes = new Uint8Array(length);
+	crypto.getRandomValues(bytes);
+	return bytes;
+}
+function bytesToHex(bytes) {
+	return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function hash(message) {
+	const msgBuffer = new TextEncoder().encode(message);
+	const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
+	return bytesToHex(new Uint8Array(hashBuffer));
+}
+/** Keyed HMAC-SHA256 for blinded fingerprints (e.g. failed-login passwords). */
+async function hmacSha256Hex(key, message) {
+	const encoder = new TextEncoder();
+	const cryptoKey = await crypto.subtle.importKey("raw", encoder.encode(key), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(message));
+	return bytesToHex(new Uint8Array(signature));
+}
+//#endregion
+export { createAPI as a, randomBytes as i, hash as n, createKV as o, hmacSha256Hex as r, bytesToHex as t };

package/dist/{dash-client-CZzJyRrV.d.mts → dash-client-CImS7uA_.d.mts}

@@ -1,3 +1,5 @@
+import { BetterAuthClientPlugin } from "better-auth";
+
 //#region src/dash-client.d.ts
 interface DashAuditLog {
   eventType: string;
@@ -54,38 +56,6 @@ interface DashClientOptions {
     session?: SessionLike | null;
   }) => string | undefined;
 }
-declare const dashClient: (options?: DashClientOptions) => {
-  id: "dash";
-  getActions: ($fetch: import("@better-fetch/fetch").BetterFetch) => {
-    dash: {
-      getAuditLogs: (input?: DashGetAuditLogsInput) => Promise<{
-        data: null;
-        error: {
-          message?: string | undefined;
-          status: number;
-          statusText: string;
-        };
-      } | {
-        data: DashAuditLogsResponse;
-        error: null;
-      }>;
-      getAllAuditLogs: (input?: DashGetAllAuditLogsInput) => Promise<{
-        data: null;
-        error: {
-          message?: string | undefined;
-          status: number;
-          statusText: string;
-        };
-      } | {
-        data: DashAuditLogsResponse;
-        error: null;
-      }>;
-    };
-  };
-  pathMethods: {
-    "/events/audit-logs": "GET";
-    "/events/all-audit-logs": "GET";
-  };
-};
+declare const dashClient: (options?: DashClientOptions) => BetterAuthClientPlugin;
 //#endregion
 export { DashGetAuditLogsInput as a, DashGetAllAuditLogsInput as i, DashAuditLogsResponse as n, dashClient as o, DashClientOptions as r, DashAuditLog as t };

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-CLYqEwMV.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-Cjw_ECs7.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";