@better-auth/infra 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to `@better-auth/infra` are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.3] - 2026-06-26
+
+### Added
+
+- **`dashCompleteInvitationHandoff`** — New `GET /dash/complete-invitation-handoff` endpoint completes invitations on the auth server after the platform validates credentials via a one-time handoff, so session cookies reach the invitee's browser.
+
+### Changed
+
+- **Invitation accept workflows** — Password and social completion endpoints enforce auth mode rules: `direct_redirect` invitations cannot use platform completion; `create_no_session` omits session cookies and revokes sessions after social completion; `create_with_session` allows passwordless user creation.
+- **SSO domain verification** — `mark-domain-verified` no longer accepts `verified: true`; domains can only be verified through DNS (`verify-domain`) or have verification cleared.
+- **User list pagination** — `getUsers` clamps `limit` (max 100) and `offset` to prevent expensive unbounded queries.
+- **Email validation** — Validation always uses the configured policy strictness; the optional MX bypass has been removed.
+
+### Security
+
+- **Trusted redirect URLs** — Invitation redirects, impersonation targets, and email callback URLs are resolved against the auth base URL and `trustedOrigins`; untrusted origins fall back or are rejected.
+- **SCIM directory sync** — Creating a directory provider with an existing `providerId` in the same organization is rejected.
+
 ## [0.3.2] - 2026-06-22
 
 ### Fixed
@@ -91,6 +109,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Fixed impossible travel security challenges.
 
+[0.3.3]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.2...infra@v0.3.3
+[0.3.2]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.1...infra@v0.3.2
 [0.3.1]: https://github.com/better-auth/infrastructure/compare/infra@v0.3.0...infra@v0.3.1
 [0.3.0]: https://github.com/better-auth/infrastructure/compare/infra@v0.2.14...infra@v0.3.0
 [0.2.14]: https://github.com/better-auth/better-auth-infra/compare/@better-auth/infra@0.2.13...@better-auth/infra@0.2.14

package/dist/client.mjs

@@ -1,5 +1,5 @@
-import { n as hash, o as createKV } from "./crypto-B1NYwfFV.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as dashClient, i as solvePoWChallenge, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout } from "./pow-retry-BfzBUq0O.mjs";
+import { n as hash, o as createKV } from "./crypto-yhK7ZLPn.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as dashClient, i as solvePoWChallenge, n as decodePoWChallenge, o as generateRequestId, r as encodePoWSolution, s as identify, t as createPowRetryTimeout } from "./pow-retry-BeuEd3ic.mjs";
 import { env } from "@better-auth/core/env";
 //#region src/sentinel/fingerprint.ts
 function murmurhash3(str, seed = 0) {

package/dist/{constants-9UwOSy9A.mjs → constants-z_1dN2O_.mjs}

@@ -1,7 +1,7 @@
 import { env } from "@better-auth/core/env";
 //#endregion
 //#region src/version.ts
-const PLUGIN_VERSION = "0.3.2";
+const PLUGIN_VERSION = "0.3.3";
 //#endregion
 //#region src/constants.ts
 /**

package/dist/{crypto-B1NYwfFV.mjs → crypto-yhK7ZLPn.mjs}

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT } from "./constants-9UwOSy9A.mjs";
+import { i as INFRA_USER_AGENT } from "./constants-z_1dN2O_.mjs";
 import { createFetch } from "@better-fetch/fetch";
 //#region src/fetch.ts
 function createAPI(options, fetchOptions) {

package/dist/email.mjs

@@ -1,4 +1,4 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-9UwOSy9A.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL } from "./constants-z_1dN2O_.mjs";
 import { logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { createFetch } from "@better-fetch/fetch";

package/dist/index.d.mts

@@ -6921,7 +6921,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
       }>)[];
       body: import("zod").ZodObject<{
         providerId: import("zod").ZodString;
-        verified: import("zod").ZodBoolean;
+        verified: import("zod").ZodLiteral<false>;
       }, import("zod/v4/core").$strip>;
     }, DashSsoMarkDomainVerifiedResponse>;
     listDashTeamMembers: import("better-call").StrictEndpoint<"/dash/organization/:orgId/teams/:teamId/members", {
@@ -7574,6 +7574,25 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         password: import("zod").ZodOptional<import("zod").ZodString>;
       }, import("zod/v4/core").$strip>;
     }, DashCompleteInvitationResponse>;
+    dashCompleteInvitationHandoff: import("better-call").StrictEndpoint<"/dash/complete-invitation-handoff", {
+      method: "GET";
+      query: import("zod").ZodObject<{
+        handoff: import("zod").ZodString;
+      }, import("zod/v4/core").$strip>;
+    }, {
+      status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | import("better-call").Status;
+      body: ({
+        message?: string;
+        code?: string;
+        cause?: unknown;
+      } & Record<string, any>) | undefined;
+      headers: HeadersInit;
+      statusCode: number;
+      name: string;
+      message: string;
+      stack?: string;
+      cause?: unknown;
+    }>;
     dashCompleteInvitationSocial: import("better-call").StrictEndpoint<"/dash/complete-invitation-social", {
       method: "GET";
       query: import("zod").ZodObject<{

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-9UwOSy9A.mjs";
-import { a as createAPI, o as createKV, r as hmacSha256Hex } from "./crypto-B1NYwfFV.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-z_1dN2O_.mjs";
+import { a as createAPI, o as createKV, r as hmacSha256Hex } from "./crypto-yhK7ZLPn.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
 import { getCurrentAuthContext } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
@@ -9,7 +9,7 @@ import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
 import { createLocalJWKSet, jwtVerify } from "jose";
 import z$1, { z } from "zod";
-import { setSessionCookie } from "better-auth/cookies";
+import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
 import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
 import { createOTP } from "@better-auth/utils/otp";
 //#region src/options.ts
@@ -1700,7 +1700,7 @@ function createEmailValidator(options) {
 	* Validate an email address
 	* Returns validation result - caller should use getPolicy() to determine action
 	*/
-async validate(email, checkMx = true) {
+async validate(email) {
 		const trimmed = email.trim();
 		const policy = await fetchPolicy();
 		if (!policy?.enabled) return {
@@ -1714,7 +1714,6 @@ async validate(email, checkMx = true) {
 				method: "POST",
 				body: {
 					email: trimmed,
-					checkMx,
 					strictness: policy.strictness
 				}
 			});
@@ -3348,6 +3347,18 @@ async function getScimProviderOwner(ctx, organizationId, providerId) {
 		select: ["userId"]
 	}))?.userId ?? null;
 }
+async function scimProviderExists(ctx, organizationId, providerId) {
+	return await ctx.context.adapter.findOne({
+		model: "scimProvider",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}, {
+			field: "providerId",
+			value: providerId
+		}]
+	}) != null;
+}
 function getScimEndpoint(baseUrl) {
 	return `${baseUrl}/scim/v2`;
 }
@@ -3415,6 +3426,7 @@ const createOrganizationDirectory = (options) => {
 		const scimPlugin = getSCIMPlugin(ctx);
 		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { providerId, ownerUserId } = ctx.body;
+		if (await scimProviderExists(ctx, organizationId, providerId)) throw ctx.error("BAD_REQUEST", { message: DIRECTORY_SYNC_DUPLICATE_MESSAGE });
 		let scimToken;
 		try {
 			scimToken = (await scimPlugin.endpoints.generateSCIMToken({
@@ -3895,6 +3907,61 @@ function usesPlatformInviteAcceptFlow(authMode) {
 function shouldCreateSessionOnInviteComplete(authMode) {
 	return authMode !== "create_no_session";
 }
+/** Password/social completion on /invite/accept (not direct_redirect). */
+function canCompleteViaPlatformAuth(authMode) {
+	return usesPlatformInviteAcceptFlow(authMode);
+}
+/** Whether complete-invitation may create a new user without a password. */
+function allowsPasswordlessInviteComplete(authMode) {
+	return authMode === "create_with_session";
+}
+//#endregion
+//#region ../utils/dist/url.mjs
+/**
+* URL helpers: normalization, SSRF-safe parsing/validation, and path/query segments.
+*/
+const HTTP_PROTOCOLS = ["http:", "https:"];
+function isAllowedProtocol(protocol, allowedProtocols) {
+	return (allowedProtocols?.length ? allowedProtocols : HTTP_PROTOCOLS).includes(protocol);
+}
+function toAllowedOriginSet(allowedOrigins) {
+	const set = /* @__PURE__ */ new Set();
+	for (const raw of allowedOrigins) try {
+		const parsed = new URL(raw.trim());
+		if (isAllowedProtocol(parsed.protocol, HTTP_PROTOCOLS)) set.add(parsed.origin);
+	} catch {}
+	return set;
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+	if (!allowedOrigins.length) return false;
+	return toAllowedOriginSet(allowedOrigins).has(origin);
+}
+function safeResolveUrl(raw, baseURL) {
+	const trim = raw.trim();
+	if (!trim) return null;
+	if (trim.startsWith("//") || trim.includes("\\")) return null;
+	if (/[\u0000-\u001F\u007F]/.test(trim)) return null;
+	try {
+		if (trim.startsWith("/")) return new URL(trim, baseURL);
+		return new URL(trim);
+	} catch {
+		return null;
+	}
+}
+function getSafeUniqueOrigins(urls) {
+	return [...toAllowedOriginSet(urls)];
+}
+/**
+* Returns an absolute URL only if its protocol and origin are allowed (after
+* resolving relative paths against `baseURL`). Otherwise returns `null`.
+*/
+function safeUrlParse(input) {
+	if (input.raw == null || input.raw.trim() === "") return null;
+	const target = safeResolveUrl(input.raw, input.baseURL);
+	if (!target || !isAllowedProtocol(target.protocol, input.allowedProtocols)) return null;
+	if (!isAllowedOrigin(target.origin, input.allowedOrigins ?? [])) return null;
+	return target.href;
+}
 //#endregion
 //#region src/lib/safe-url.ts
 function isSafeHttpUrl(value) {
@@ -3908,12 +3975,44 @@ function isSafeHttpUrl(value) {
 /** http(s) absolute URL without embedded credentials. */
 const safeUrlSchema = z$1.string().trim().min(1).pipe(z$1.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
 const optionalSafeUrlSchema = z$1.union([safeUrlSchema, z$1.literal("")]).optional();
-/** Validates http(s) redirect targets at use time; falls back when invalid. */
-function resolveSafeRedirectUrl(raw, fallback) {
-	if (raw == null || raw.trim() === "") return fallback;
-	const parsed = safeUrlSchema.safeParse(raw);
-	if (!parsed.success) return fallback;
-	return parsed.data;
+function getAuthBaseUrl(ctx) {
+	const baseURL = ctx.context.options.baseURL;
+	return typeof baseURL === "string" && baseURL.trim() ? baseURL : "/";
+}
+function getAllowedAuthOrigins(ctx, extraOrigins = []) {
+	const baseURL = getAuthBaseUrl(ctx);
+	const trusted = ctx.context.options.trustedOrigins;
+	return getSafeUniqueOrigins([
+		baseURL,
+		...Array.isArray(trusted) ? trusted.filter((origin) => typeof origin === "string") : [],
+		...extraOrigins
+	]);
+}
+/**
+* Resolve a redirect against the auth server's base URL and trusted origins.
+* Falls back when the target origin is not allowed.
+*/
+function resolveTrustedAuthRedirectUrl(ctx, raw, fallback) {
+	return safeUrlParse({
+		raw,
+		baseURL: getAuthBaseUrl(ctx),
+		allowedOrigins: getAllowedAuthOrigins(ctx)
+	}) ?? fallback;
+}
+/** Returns a trusted redirect URL or null when the origin is not allowed. */
+function parseTrustedAuthRedirectUrl(ctx, raw) {
+	return safeUrlParse({
+		raw,
+		baseURL: getAuthBaseUrl(ctx),
+		allowedOrigins: getAllowedAuthOrigins(ctx)
+	});
+}
+const TRUSTED_CALLBACK_URL_ERROR = "Callback URL must use http(s) and match the auth base URL or a trusted origin.";
+/** Rejects email/redirect callbacks whose origin is not on the auth allowlist. */
+function requireTrustedAuthCallbackUrl(ctx, raw) {
+	const trusted = parseTrustedAuthRedirectUrl(ctx, raw);
+	if (!trusted) throw new APIError$1("BAD_REQUEST", { message: TRUSTED_CALLBACK_URL_ERROR });
+	return trusted;
 }
 //#endregion
 //#region src/routes/invitations/index.ts
@@ -3939,11 +4038,56 @@ async function verifyPendingInvitation(token, $api, ctx) {
 	}
 	return invitation;
 }
-function getFallbackRedirect(ctx) {
-	return typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : "/";
-}
-function resolveInvitationRedirect(ctx, raw) {
-	return resolveSafeRedirectUrl(raw, getFallbackRedirect(ctx));
+async function executePlatformInvitationCompletion(ctx, $api, invitation, args) {
+	if (!canCompleteViaPlatformAuth(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "This invitation cannot be completed through this endpoint." });
+	if (!ctx.context) throw new APIError("BAD_REQUEST", { message: "Context is required" });
+	const { token, password } = args;
+	const invitationEmail = normalizeEmail(invitation.email, ctx.context);
+	const existingUser = await ctx.context.internalAdapter.findUserByEmail(invitationEmail).then((user) => user?.user);
+	if (existingUser) {
+		const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
+			method: "POST",
+			body: {
+				token,
+				userId: existingUser.id
+			}
+		});
+		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
+			session: await ctx.context.internalAdapter.createSession(existingUser.id),
+			user: existingUser
+		});
+		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
+	}
+	if (!password && !allowsPasswordlessInviteComplete(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
+	const userPayload = {
+		email: invitationEmail,
+		name: invitation.name || invitation.email.split("@")[0] || "",
+		emailVerified: true,
+		createdAt: /* @__PURE__ */ new Date(),
+		updatedAt: /* @__PURE__ */ new Date()
+	};
+	const adapter = ctx.context.internalAdapter;
+	const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
+	if (password) await ctx.context.internalAdapter.createAccount({
+		userId: user.id,
+		providerId: "credential",
+		accountId: user.id,
+		password: await ctx.context.password.hash(password)
+	});
+	const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
+		method: "POST",
+		body: {
+			token,
+			userId: user.id
+		}
+	});
+	if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
+	if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
+		session: await ctx.context.internalAdapter.createSession(user.id),
+		user
+	});
+	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
 }
 /**
 * Accept invitation endpoint
@@ -3973,7 +4117,7 @@ const acceptInvitation = (options) => {
 				session: await ctx.context.internalAdapter.createSession(existingUser.id),
 				user: existingUser
 			});
-			const redirectUrl = resolveInvitationRedirect(ctx, invitation.redirectUrl);
+			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
 			return ctx.redirect(redirectUrl);
 		}
 		if (usesPlatformInviteAcceptFlow(invitation.authMode)) {
@@ -4005,7 +4149,7 @@ const acceptInvitation = (options) => {
 			session: await ctx.context.internalAdapter.createSession(user.id),
 			user
 		});
-		const redirectUrl = resolveInvitationRedirect(ctx, invitation.redirectUrl);
+		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
 		return ctx.redirect(redirectUrl);
 	});
 };
@@ -4024,62 +4168,38 @@ const completeInvitation = (options) => {
 		})
 	}, async (ctx) => {
 		const { token, password } = ctx.body;
-		const invitation = await verifyPendingInvitation(token, $api, ctx);
-		if (!ctx.context) throw new APIError("BAD_REQUEST", { message: "Context is required" });
-		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
-		const existingUser = await ctx.context.internalAdapter.findUserByEmail(invitationEmail).then((user) => user?.user);
-		if (existingUser) {
-			const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
-				method: "POST",
-				body: {
-					token,
-					userId: existingUser.id
-				}
-			});
-			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-				session: await ctx.context.internalAdapter.createSession(existingUser.id),
-				user: existingUser
-			});
-			return {
-				success: true,
-				redirectUrl: resolveInvitationRedirect(ctx, invitation.redirectUrl)
-			};
-		}
-		if (!password) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
-		const userPayload = {
-			email: invitationEmail,
-			name: invitation.name || invitation.email.split("@")[0] || "",
-			emailVerified: true,
-			createdAt: /* @__PURE__ */ new Date(),
-			updatedAt: /* @__PURE__ */ new Date()
-		};
-		const adapter = ctx.context.internalAdapter;
-		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
-		await ctx.context.internalAdapter.createAccount({
-			userId: user.id,
-			providerId: "credential",
-			accountId: user.id,
-			password: await ctx.context.password.hash(password)
-		});
-		const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
-			method: "POST",
-			body: {
-				token,
-				userId: user.id
-			}
-		});
-		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-			session: await ctx.context.internalAdapter.createSession(user.id),
-			user
+		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, await verifyPendingInvitation(token, $api, ctx), {
+			token,
+			password
 		});
 		return {
 			success: true,
-			redirectUrl: resolveInvitationRedirect(ctx, invitation.redirectUrl)
+			redirectUrl
 		};
 	});
 };
+/**
+* Browser handoff completion — runs on the auth server so Set-Cookie reaches the invitee.
+* The platform stores a one-time handoff after validating the invitation (and password).
+*/
+const completeInvitationHandoff = (options) => {
+	const { $api } = options;
+	return createAuthEndpoint("/dash/complete-invitation-handoff", {
+		method: "GET",
+		query: z$1.object({ handoff: z$1.string().min(1) })
+	}, async (ctx) => {
+		const { data, error } = await $api("/api/internal/invitations/redeem-handoff", {
+			method: "POST",
+			body: { handoff: ctx.query.handoff }
+		});
+		if (error || !data?.invitationToken) throw new APIError("BAD_REQUEST", { message: "This invitation link has expired. Please try again." });
+		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, await verifyPendingInvitation(data.invitationToken, $api, ctx), {
+			token: data.invitationToken,
+			password: data.password ?? void 0
+		});
+		return ctx.redirect(redirectUrl);
+	});
+};
 const completeInvitationSocial = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation-social", {
@@ -4090,6 +4210,7 @@ const completeInvitationSocial = (options) => {
 		const sessionUser = ctx.context.session?.user;
 		if (!sessionUser) throw new APIError("UNAUTHORIZED", { message: "Authentication required." });
 		const invitation = await verifyPendingInvitation(ctx.query.token, $api, ctx);
+		if (!canCompleteViaPlatformAuth(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "This invitation cannot be completed through this endpoint." });
 		const invitationEmail = normalizeEmail(invitation.email, ctx.context);
 		const sessionEmail = sessionUser.email ? normalizeEmail(sessionUser.email, ctx.context) : null;
 		if (!sessionEmail || sessionEmail !== invitationEmail) throw new APIError("BAD_REQUEST", { message: "Signed-in account does not match this invitation." });
@@ -4101,7 +4222,12 @@ const completeInvitationSocial = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		return ctx.redirect(resolveInvitationRedirect(ctx, invitation.redirectUrl));
+		if (!shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+			const sessionCookieToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+			if (sessionCookieToken) await ctx.context.internalAdapter.deleteSession(sessionCookieToken);
+			deleteSessionCookie(ctx);
+		}
+		return ctx.redirect(resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)));
 	});
 };
 /**
@@ -6532,14 +6658,14 @@ const markSsoProviderDomainVerified = (options) => {
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
 		body: z$1.object({
 			providerId: z$1.string(),
-			verified: z$1.boolean()
+			verified: z$1.literal(false).describe("Clears domain verification. Domains can only be marked verified via DNS (verify-domain).")
 		})
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
 		if (!getSSOPlugin(ctx)?.options?.domainVerification?.enabled) throw ctx.error("BAD_REQUEST", { message: "SSO plugin with domain verification is not enabled or feature is not supported in your plugin version" });
 		const organizationId = tryDecode(ctx.params.id);
-		const { providerId, verified } = ctx.body;
+		const { providerId } = ctx.body;
 		const provider = await ctx.context.adapter.findOne({
 			model: "ssoProvider",
 			where: [{
@@ -6557,12 +6683,12 @@ const markSsoProviderDomainVerified = (options) => {
 				field: "providerId",
 				value: provider.providerId
 			}],
-			update: { domainVerified: verified }
+			update: { domainVerified: false }
 		});
 		return {
 			success: true,
-			domainVerified: verified,
-			message: verified ? "Domain marked as verified" : "Domain verification unmarked"
+			domainVerified: false,
+			message: "Domain verification unmarked"
 		};
 	});
 };
@@ -7004,6 +7130,18 @@ function parseWhereClause(val) {
 	if (!Array.isArray(parsed)) return [];
 	return parsed;
 }
+const USER_LIST_MAX_LIMIT = 100;
+const USER_LIST_DEFAULT_LIMIT = 10;
+function clampUserListLimit(value, fallback = USER_LIST_DEFAULT_LIMIT) {
+	const n = typeof value === "number" ? value : Number(value);
+	if (!Number.isFinite(n)) return fallback;
+	return Math.min(Math.max(1, Math.floor(n)), USER_LIST_MAX_LIMIT);
+}
+function clampUserListOffset(value, fallback = 0) {
+	const n = typeof value === "number" ? value : Number(value);
+	if (!Number.isFinite(n)) return fallback;
+	return Math.max(0, Math.floor(n));
+}
 const getUsersQuerySchema = z$1.object({
 	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
 	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
@@ -7027,10 +7165,12 @@ const getUsers = (options) => {
 		})();
 		const where = ctx.query?.where?.length ? ctx.query.where : void 0;
 		const countWhere = ctx.query?.countWhere?.length ? ctx.query.countWhere : void 0;
+		const limit = clampUserListLimit(ctx.query?.limit, USER_LIST_DEFAULT_LIMIT);
+		const offset = clampUserListOffset(ctx.query?.offset);
 		const userQuery = ctx.context.adapter.findMany({
 			model: "user",
-			limit: ctx.query?.limit || 10,
-			offset: ctx.query?.offset ? ctx.query.offset : 0,
+			limit,
+			offset,
 			sortBy: {
 				field: ctx.query?.sortBy || "createdAt",
 				direction: ctx.query?.sortOrder || "desc"
@@ -7168,6 +7308,8 @@ const impersonateUser = (options) => {
 	}, async (ctx) => {
 		const { userId, redirectUrl, impersonatedBy } = ctx.context.payload;
 		if (!(userId && redirectUrl)) throw ctx.error("BAD_REQUEST", { message: "Invalid token" });
+		const trustedRedirectUrl = parseTrustedAuthRedirectUrl(ctx, redirectUrl);
+		if (!trustedRedirectUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid redirect URL" });
 		const session = await ctx.context.internalAdapter.createSession(userId, true, {
 			expiresAt: new Date(Date.now() + 1e3 * 60 * 10),
 			impersonatedBy: impersonatedBy || void 0
@@ -7178,7 +7320,7 @@ const impersonateUser = (options) => {
 			session,
 			user
 		}, true);
-		throw ctx.redirect(redirectUrl);
+		throw ctx.redirect(trustedRedirectUrl);
 	});
 };
 const createUser = (options) => {
@@ -8019,7 +8161,7 @@ const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verifi
 	body: z$1.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
-	const { callbackUrl } = ctx.body;
+	const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
 	if (user.emailVerified) throw ctx.error("BAD_REQUEST", { message: "Email is already verified" });
@@ -8042,7 +8184,7 @@ const sendManyVerificationEmails = (options) => {
 	}, async (ctx) => {
 		if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
 		const { userIds } = ctx.context.payload;
-		const { callbackUrl } = ctx.body;
+		const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
 		const sentEmailUserIds = /* @__PURE__ */ new Set();
 		const skippedEmailUserIds = /* @__PURE__ */ new Set();
 		const start = performance.now();
@@ -8101,10 +8243,11 @@ const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset
 	body: z$1.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
+	const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	if (!user) throw ctx.error("NOT_FOUND", { message: "User not found" });
 	if (!user.email) throw ctx.error("BAD_REQUEST", { message: "User has no associated email address" });
-	ctx.body.redirectTo = ctx.body.callbackUrl;
+	ctx.body.redirectTo = callbackUrl;
 	ctx.body.email = user.email;
 	return await requestPasswordReset(ctx);
 });
@@ -8717,6 +8860,7 @@ const dash = (options) => {
 			getEventTypes: getEventTypes(settings),
 			dashAcceptInvitation: acceptInvitation(settings),
 			dashCompleteInvitation: completeInvitation(settings),
+			dashCompleteInvitationHandoff: completeInvitationHandoff(settings),
 			dashCompleteInvitationSocial: completeInvitationSocial(settings),
 			dashCheckUserExists: checkUserExists(settings),
 			listDashOrganizationDirectories: listOrganizationDirectories(settings),

package/dist/native.mjs

@@ -1,5 +1,5 @@
-import { o as createKV, t as bytesToHex } from "./crypto-B1NYwfFV.mjs";
-import { a as resolveSentinelClientIdentifyUrl, c as dashClient, i as solvePoWChallenge, n as decodePoWChallenge, r as encodePoWSolution, s as identify, t as createPowRetryTimeout } from "./pow-retry-BfzBUq0O.mjs";
+import { o as createKV, t as bytesToHex } from "./crypto-yhK7ZLPn.mjs";
+import { a as resolveSentinelClientIdentifyUrl, c as dashClient, i as solvePoWChallenge, n as decodePoWChallenge, r as encodePoWSolution, s as identify, t as createPowRetryTimeout } from "./pow-retry-BeuEd3ic.mjs";
 import { env } from "@better-auth/core/env";
 import { Dimensions, InteractionManager, PixelRatio, Platform } from "react-native";
 //#region src/sentinel/native/components.ts

package/dist/{pow-retry-BfzBUq0O.mjs → pow-retry-BeuEd3ic.mjs}

@@ -1,4 +1,4 @@
-import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-B1NYwfFV.mjs";
+import { i as randomBytes, n as hash, t as bytesToHex } from "./crypto-yhK7ZLPn.mjs";
 //#region src/dash-client.ts
 function resolveDashUserId(input, options) {
 	return input.userId || options?.resolveUserId?.({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/infra",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Dashboard and analytics plugin for Better Auth",
   "type": "module",
   "main": "dist/index.mjs",