@payez/next-mvp 4.1.21 → 4.4.0

package/dist/auth/utils/idp-client.js

@@ -36,7 +36,7 @@ function getIdpUrl() {
  * Get client ID for this application.
  */
 function getClientId() {
-    const clientId = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
+    const clientId = process.env.CLIENT_ID;
     if (!clientId) {
         throw new Error('[IDP_CLIENT] FATAL: CLIENT_ID environment variable is REQUIRED');
     }

package/dist/client/AuthContext.js

@@ -32,6 +32,8 @@ const OAUTH_PROVIDER_IDS = ['google', 'apple', 'facebook', 'github', 'azure-ad',
 function AuthProvider({ children, config, useDynamicProviders = true }) {
     const [dynamicProviders, setDynamicProviders] = (0, react_1.useState)([]);
     const [providersLoaded, setProvidersLoaded] = (0, react_1.useState)(!useDynamicProviders);
+    // What the IDP says this client offers. null until /api/auth/settings answers.
+    const [serverSettings, setServerSettings] = (0, react_1.useState)(null);
     // Create QueryClient instance for React Query - used internally by MVP hooks
     const [queryClient] = (0, react_1.useState)(() => new react_query_1.QueryClient({
         defaultOptions: {
@@ -49,24 +51,45 @@ function AuthProvider({ children, config, useDynamicProviders = true }) {
         let mounted = true;
         async function fetchDynamicProviders() {
             try {
-                // Better Auth doesn't have a getProviders equivalent.
-                // Use static provider map based on configured social providers.
-                const result = {
-                    google: { id: 'google', name: 'Google' },
-                };
-                if (!mounted)
+                // READ THE IDP. This used to be a hardcoded literal:
+                //     const result = { google: { id: 'google', name: 'Google' } };
+                // sitting under a comment saying providers were loaded dynamically. It returned
+                // Google for every client regardless of what the tenant actually had enabled -
+                // a config-shaped constant, which is the one thing configuration must never be.
+                //
+                // /api/auth/settings already serves the real answer (enabledProviders,
+                // allowFederatedLogin, enablePasswordReset) and nothing consumed it.
+                const response = await fetch('/api/auth/settings');
+                if (!response.ok) {
+                    // No silent substitution. Absent settings means we do not know what this
+                    // client offers, and inventing a provider list is how a tenant ends up with a
+                    // sign-in button their IDP will refuse.
+                    console.error('[AuthProvider] /api/auth/settings returned ' + response.status +
+                        ' - provider list unknown. Mount ./routes/auth/settings.');
                     return;
-                if (result) {
-                    // Filter to OAuth providers only and map to FederatedProvider type
-                    const oauthProviders = Object.keys(result)
-                        .filter(id => OAUTH_PROVIDER_IDS.includes(id))
-                        .map(id => PROVIDER_MAP[id])
-                        .filter((p) => p !== undefined);
-                    setDynamicProviders(oauthProviders);
                 }
+                const body = await response.json();
+                const settings = body?.data ?? body;
+                if (!mounted)
+                    return;
+                const ids = Array.isArray(settings?.enabledProviders)
+                    ? settings.enabledProviders
+                    : [];
+                const oauthProviders = ids
+                    .filter(id => OAUTH_PROVIDER_IDS.includes(id))
+                    .map(id => PROVIDER_MAP[id])
+                    .filter((p) => p !== undefined);
+                setDynamicProviders(oauthProviders);
+                setServerSettings({
+                    allowFederatedLogin: settings?.allowFederatedLogin !== false,
+                    // TRADITIONAL DEFAULTS ON. The IDP does not carry an explicit flag for it yet;
+                    // until it does, username/password is available unless a site opts out. An
+                    // OAuth-only client is a deliberate choice, not the default.
+                    allowTraditionalLogin: settings?.allowTraditionalLogin !== false,
+                });
             }
             catch (err) {
-                // Fall back to static config providers on error
+                console.error('[AuthProvider] could not read /api/auth/settings:', err);
             }
             finally {
                 if (mounted) {
@@ -86,7 +109,12 @@ function AuthProvider({ children, config, useDynamicProviders = true }) {
     const authConfig = {
         ...defaultConfig,
         ...config,
-        providers, // Override with dynamic providers if enabled
+        providers, // from the IDP when useDynamicProviders is on
+        // THE SERVER DECIDES, THE SITE MAY OVERRIDE. A site that passes an explicit value
+        // still wins; absent that, what the tenant's IDP reports is what renders. A client
+        // hardcoding its own auth mode is how a sign-in screen and its IDP disagree.
+        allowFederatedLogin: config?.allowFederatedLogin ?? serverSettings?.allowFederatedLogin ?? true,
+        allowTraditionalLogin: config?.allowTraditionalLogin ?? serverSettings?.allowTraditionalLogin ?? true,
     };
     return ((0, jsx_runtime_1.jsx)(react_query_1.QueryClientProvider, { client: queryClient, children: (0, jsx_runtime_1.jsx)(AuthContext.Provider, { value: authConfig, children: children }) }));
 }
@@ -107,9 +135,13 @@ function useFederatedProviders() {
 }
 function useFederatedAuthEnabled() {
     const config = useAuthConfig();
-    return config.mode === 'federated' && config.providers.length > 0;
+    // Was `config.mode === 'federated'`, which made the two mutually exclusive and let a
+    // site's hardcoded mode silently hide what the IDP offers.
+    return config.allowFederatedLogin !== false && config.providers.length > 0;
 }
 function useTraditionalAuthEnabled() {
     const config = useAuthConfig();
-    return config.mode === 'traditional';
+    // Was `config.mode === 'traditional'`. Both can be on at once - that is the normal
+    // case, and OAuth-only is the exception a client opts into.
+    return config.allowTraditionalLogin !== false;
 }

package/dist/client/better-auth-client.d.ts

@@ -24,7 +24,7 @@ export declare const authClient: {
             metadata?: Record<string, any> | undefined;
         } & {
             fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+        }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
             status: boolean;
         }, {
             code?: string | undefined;
@@ -46,7 +46,7 @@ export declare const authClient: {
                 newUserCallbackURL?: string | undefined;
             };
             fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<Omit<{
+        }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<Omit<{
             token: string;
             user: {
                 id: string;
@@ -124,7 +124,7 @@ export declare const authClient: {
             additionalData?: Record<string, any> | undefined;
         } & {
             fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+        }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
             redirect: boolean;
             url: string;
         } | (Omit<{
@@ -159,7 +159,7 @@ export declare const authClient: {
     signOut: <FetchOptions extends import("@better-auth/core").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth/react").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         success: boolean;
     }, {
         code?: string | undefined;
@@ -181,7 +181,7 @@ export declare const authClient: {
             image?: string | undefined;
             callbackURL?: string | undefined;
             fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<(Omit<{
+        }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<(Omit<{
             token: null;
             user: {
                 id: string;
@@ -242,7 +242,7 @@ export declare const authClient: {
             rememberMe?: boolean | undefined;
         } & {
             fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<Omit<{
+        }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<Omit<{
             redirect: boolean;
             token: string;
             url?: string | undefined;
@@ -281,7 +281,7 @@ export declare const authClient: {
         token?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -297,7 +297,7 @@ export declare const authClient: {
             callbackURL?: string | undefined;
         };
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<NonNullable<void | {
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<NonNullable<void | {
         status: boolean;
     }>, {
         code?: string | undefined;
@@ -312,7 +312,7 @@ export declare const authClient: {
         callbackURL?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -327,7 +327,7 @@ export declare const authClient: {
         callbackURL?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -344,7 +344,7 @@ export declare const authClient: {
         revokeOtherSessions?: boolean | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<Omit<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<Omit<{
         token: string | null;
         user: {
             id: string;
@@ -380,7 +380,7 @@ export declare const authClient: {
 } & {
     updateSession: <FetchOptions extends import("@better-auth/core").ClientFetchOption<Partial<Partial<{}>> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth/react").Prettify<Partial<{}> & {
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         session: {
             id: string;
             createdAt: Date;
@@ -405,16 +405,16 @@ export declare const authClient: {
             $InferServerPlugin: ReturnType<(options: import("better-auth/plugins/magic-link").MagicLinkOptions) => {
                 id: "magic-link";
                 endpoints: {
-                    signInMagicLink: import("better-auth/*").StrictEndpoint<"/sign-in/magic-link", {
+                    signInMagicLink: import("better-call").StrictEndpoint<"/sign-in/magic-link", {
                         method: "POST";
                         requireHeaders: true;
-                        body: import("better-auth/*").ZodObject<{
-                            email: import("better-auth/*").ZodEmail;
-                            name: import("better-auth/*").ZodOptional<import("better-auth/*").ZodString>;
-                            callbackURL: import("better-auth/*").ZodOptional<import("better-auth/*").ZodString>;
-                            newUserCallbackURL: import("better-auth/*").ZodOptional<import("better-auth/*").ZodString>;
-                            errorCallbackURL: import("better-auth/*").ZodOptional<import("better-auth/*").ZodString>;
-                            metadata: import("better-auth/*").ZodOptional<import("better-auth/*").ZodRecord<import("better-auth/*").ZodString, import("better-auth/*").ZodAny>>;
+                        body: import("zod").ZodObject<{
+                            email: import("zod").ZodEmail;
+                            name: import("zod").ZodOptional<import("zod").ZodString>;
+                            callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                            newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                            errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                            metadata: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
                         }, import("better-auth/*").$strip>;
                         metadata: {
                             openapi: {
@@ -442,15 +442,15 @@ export declare const authClient: {
                     }, {
                         status: boolean;
                     }>;
-                    magicLinkVerify: import("better-auth/*").StrictEndpoint<"/magic-link/verify", {
+                    magicLinkVerify: import("better-call").StrictEndpoint<"/magic-link/verify", {
                         method: "GET";
-                        query: import("better-auth/*").ZodObject<{
-                            token: import("better-auth/*").ZodString;
-                            callbackURL: import("better-auth/*").ZodOptional<import("better-auth/*").ZodString>;
-                            errorCallbackURL: import("better-auth/*").ZodOptional<import("better-auth/*").ZodString>;
-                            newUserCallbackURL: import("better-auth/*").ZodOptional<import("better-auth/*").ZodString>;
+                        query: import("zod").ZodObject<{
+                            token: import("zod").ZodString;
+                            callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                            errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+                            newUserCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
                         }, import("better-auth/*").$strip>;
-                        use: ((inputContext: import("better-auth/*").MiddlewareInputContext<import("better-auth/*").MiddlewareOptions>) => Promise<void>)[];
+                        use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>)[];
                         requireHeaders: true;
                         metadata: {
                             openapi: {
@@ -499,7 +499,7 @@ export declare const authClient: {
                 options: import("better-auth/plugins/magic-link").MagicLinkOptions;
             }>;
         }[];
-    }, FetchOptions>> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }, FetchOptions>> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -516,7 +516,7 @@ export declare const authClient: {
         token?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         success: boolean;
         message: string;
     }, {
@@ -532,7 +532,7 @@ export declare const authClient: {
         redirectTo?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
         message: string;
     }, {
@@ -550,7 +550,7 @@ export declare const authClient: {
                 callbackURL: string;
             };
             fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<never, {
+        }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<never, {
             code?: string | undefined;
             message?: string | undefined;
         }, FetchOptions["throw"] extends true ? true : false>>;
@@ -559,7 +559,7 @@ export declare const authClient: {
     listSessions: <FetchOptions extends import("@better-auth/core").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth/react").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<import("better-auth/react").Prettify<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<import("better-auth/react").Prettify<{
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -579,7 +579,7 @@ export declare const authClient: {
         token: string;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -589,7 +589,7 @@ export declare const authClient: {
     revokeSessions: <FetchOptions extends import("@better-auth/core").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth/react").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -599,7 +599,7 @@ export declare const authClient: {
     revokeOtherSessions: <FetchOptions extends import("@better-auth/core").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth/react").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -638,7 +638,7 @@ export declare const authClient: {
         additionalData?: Record<string, any> | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         url: string;
         redirect: boolean;
     }, {
@@ -649,7 +649,7 @@ export declare const authClient: {
     listAccounts: <FetchOptions extends import("@better-auth/core").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth/react").Prettify<{
         query?: Record<string, any> | undefined;
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         scopes: string[];
         id: string;
         createdAt: Date;
@@ -672,7 +672,7 @@ export declare const authClient: {
                 callbackURL?: string | undefined;
             };
             fetchOptions?: FetchOptions | undefined;
-        }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+        }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
             success: boolean;
             message: string;
         }, {
@@ -689,7 +689,7 @@ export declare const authClient: {
         accountId?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -706,7 +706,7 @@ export declare const authClient: {
         userId?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         accessToken: string | undefined;
         refreshToken: string;
         accessTokenExpiresAt: Date | undefined;
@@ -730,7 +730,7 @@ export declare const authClient: {
         userId?: string | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         accessToken: string;
         accessTokenExpiresAt: Date | undefined;
         scopes: string[];
@@ -747,7 +747,7 @@ export declare const authClient: {
             accountId?: string | undefined;
         } | undefined;
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         user: import("better-auth/*").OAuth2UserInfo;
         data: Record<string, any>;
     }, {
@@ -764,7 +764,7 @@ export declare const authClient: {
             disableRefresh?: unknown;
         } | undefined;
         fetchOptions?: FetchOptions | undefined;
-    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         user: import("better-auth/react").StripEmptyObjects<{
             id: string;
             createdAt: Date;
@@ -813,7 +813,7 @@ export declare const authClient: {
         } | null;
         isPending: boolean;
         isRefetching: boolean;
-        error: import("better-auth/react").BetterFetchError | null;
+        error: import("@better-fetch/fetch").BetterFetchError | null;
         refetch: (queryParams
         /**
          * NextAuth-compatible signOut wrapper.
@@ -847,21 +847,21 @@ export declare const authClient: {
             }>;
         };
     };
-    $fetch: import("better-auth/react").BetterFetch<{
-        plugins: (import("better-auth/react").BetterFetchPlugin<Record<string, any>> | {
+    $fetch: import("@better-fetch/fetch").BetterFetch<{
+        plugins: (import("@better-fetch/fetch").BetterFetchPlugin<Record<string, any>> | {
             id: string;
             name: string;
             hooks: {
-                onSuccess(context: import("better-auth/react").SuccessContext<any>): void;
+                onSuccess(context: import("@better-fetch/fetch").SuccessContext<any>): void;
             };
         } | {
             id: string;
             name: string;
             hooks: {
-                onSuccess: ((context: import("better-auth/react").SuccessContext<any>) => Promise<void> | void) | undefined;
-                onError: ((context: import("better-auth/react").ErrorContext) => Promise<void> | void) | undefined;
-                onRequest: (<T extends Record<string, any>>(context: import("better-auth/react").RequestContext<T>) => Promise<import("better-auth/react").RequestContext | void> | import("better-auth/react").RequestContext | void) | undefined;
-                onResponse: ((context: import("better-auth/react").ResponseContext) => Promise<Response | void | import("better-auth/react").ResponseContext> | Response | import("better-auth/react").ResponseContext | void) | undefined;
+                onSuccess: ((context: import("@better-fetch/fetch").SuccessContext<any>) => Promise<void> | void) | undefined;
+                onError: ((context: import("@better-fetch/fetch").ErrorContext) => Promise<void> | void) | undefined;
+                onRequest: (<T extends Record<string, any>>(context: import("@better-fetch/fetch").RequestContext<T>) => Promise<import("@better-fetch/fetch").RequestContext | void> | import("@better-fetch/fetch").RequestContext | void) | undefined;
+                onResponse: ((context: import("@better-fetch/fetch").ResponseContext) => Promise<Response | void | import("@better-fetch/fetch").ResponseContext> | Response | import("@better-fetch/fetch").ResponseContext | void) | undefined;
             };
         })[];
         cache?: RequestCache | undefined;
@@ -881,12 +881,12 @@ export declare const authClient: {
         referrerPolicy?: ReferrerPolicy | undefined;
         signal?: (AbortSignal | null) | undefined;
         window?: null | undefined;
-        onRetry?: ((response: import("better-auth/react").ResponseContext) => Promise<void> | void) | undefined;
+        onRetry?: ((response: import("@better-fetch/fetch").ResponseContext) => Promise<void> | void) | undefined;
         hookOptions?: {
             cloneResponse?: boolean;
         } | undefined;
         timeout?: number | undefined;
-        customFetchImpl: import("better-auth/react").FetchEsque;
+        customFetchImpl: import("@better-fetch/fetch").FetchEsque;
         baseURL: string;
         throw?: boolean | undefined;
         auth?: ({
@@ -906,17 +906,17 @@ export declare const authClient: {
         params?: any;
         duplex?: "full" | "half" | undefined;
         jsonParser: (text: string) => Promise<any> | any;
-        retry?: import("better-auth/react").RetryOptions | undefined;
+        retry?: import("@better-fetch/fetch").RetryOptions | undefined;
         retryAttempt?: number | undefined;
-        output?: (import("better-auth/react").StandardSchemaV1 | typeof Blob | typeof File) | undefined;
-        errorSchema?: import("better-auth/react").StandardSchemaV1 | undefined;
+        output?: (import("@better-fetch/fetch").StandardSchemaV1 | typeof Blob | typeof File) | undefined;
+        errorSchema?: import("@better-fetch/fetch").StandardSchemaV1 | undefined;
         disableValidation?: boolean | undefined;
         disableSignal?: boolean | undefined;
     }, unknown, unknown, {}>;
     $store: {
         notify: (signal?: (Omit<string, "$sessionSignal"> | "$sessionSignal") | undefined) => void;
         listen: (signal: Omit<string, "$sessionSignal"> | "$sessionSignal", listener: (value: boolean, oldValue?: boolean | undefined) => void) => void;
-        atoms: Record<string, import("better-auth/react").WritableAtom<any>>;
+        atoms: Record<string, import("nanostores/atom").WritableAtom<any>>;
     };
     $ERROR_CODES: {
         USER_NOT_FOUND: import("better-auth/*").RawError<"USER_NOT_FOUND">;
@@ -993,7 +993,7 @@ export declare const useSession: () => {
     } | null;
     isPending: boolean;
     isRefetching: boolean;
-    error: import("better-auth/react").BetterFetchError | null;
+    error: import("@better-fetch/fetch").BetterFetchError | null;
     refetch: (queryParams
     /**
      * NextAuth-compatible signOut wrapper.
@@ -1020,7 +1020,7 @@ export declare const useSession: () => {
         metadata?: Record<string, any> | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         status: boolean;
     }, {
         code?: string | undefined;
@@ -1077,7 +1077,7 @@ export declare const useSession: () => {
         additionalData?: Record<string, any> | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
         redirect: boolean;
         url: string;
     } | (Omit<{
@@ -1120,7 +1120,7 @@ export declare const useSession: () => {
         rememberMe?: boolean | undefined;
     } & {
         fetchOptions?: FetchOptions | undefined;
-    }>, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<Omit<{
+    }>, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<Omit<{
         redirect: boolean;
         token: string;
         url?: string | undefined;
@@ -1150,7 +1150,7 @@ export declare const useSession: () => {
 }, signOut: <FetchOptions extends import("@better-auth/core").ClientFetchOption<never, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0?: import("better-auth/react").Prettify<{
     query?: Record<string, any> | undefined;
     fetchOptions?: FetchOptions | undefined;
-}> | undefined, data_1?: FetchOptions | undefined) => Promise<import("better-auth/react").BetterFetchResponse<{
+}> | undefined, data_1?: FetchOptions | undefined) => Promise<import("@better-fetch/fetch").BetterFetchResponse<{
     success: boolean;
 }, {
     code?: string | undefined;

package/dist/components/account/UserAvatarMenu.js

@@ -67,6 +67,18 @@ function UserAvatarMenu({ basePath = '', showProfile = true, showSettings = true
         else {
             // Use NEXT_PUBLIC env var or default to root
             const logoutUrl = process.env.NEXT_PUBLIC_LOGOUT_REDIRECT_URL || '/';
+            // 272068: revoke server-side BEFORE the better-auth client sign-out clears
+            // the cookie jar. authClient.signOut() ALONE leaves the server-side sess
+            // record alive - a copied pre-signout cookie still authenticates. The
+            // logout route (routes/auth/logout) runs deleteSessionEverywhere and
+            // clears the __Secure- twin; it must still see the cookie, so it goes
+            // first. Best-effort: a failed revoke must not trap the user on the page.
+            try {
+                await fetch('/api/auth/logout', { method: 'POST', credentials: 'include' });
+            }
+            catch {
+                // sign-out continues regardless
+            }
             await better_auth_client_1.authClient.signOut();
             window.location.href = logoutUrl;
         }

package/dist/components/auth/ModeAwareLoginPage.js

@@ -27,16 +27,18 @@ function ModeAwareLoginPage({ onFederatedSignIn, onTraditionalSignIn, onForgotPa
             setLocalLoading(false);
         }
     };
-    const isFederated = config.mode === 'federated';
-    const isTraditional = config.mode === 'traditional';
+    // READ THE FLAGS, NOT `mode`. A single mode made these mutually exclusive, so a site
+    // could only ever show ONE of OAuth or username/password. Both are normal together;
+    // OAuth-only is the exception a client opts into. Source is the IDP
+    // (/api/auth/settings) unless the site deliberately overrides.
+    const isFederated = config.allowFederatedLogin !== false && config.providers.length > 0;
+    const isTraditional = config.allowTraditionalLogin !== false;
     const totalLoading = isLoading || localLoading;
     return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [error && ((0, jsx_runtime_1.jsx)("div", { className: "mb-6 px-4 py-3 rounded-lg", style: {
                     background: 'var(--color-error, #ef4444)',
                     color: 'white',
-                }, children: error })), isFederated && ((0, jsx_runtime_1.jsx)(FederatedAuthSection_1.FederatedAuthSection, { providers: config.providers, onProviderClick: handleFederatedClick, isLoading: totalLoading })), isTraditional && ((0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: setEmail, onPasswordChange: setPassword, onSubmit: handleTraditionalSubmit, isLoading: totalLoading, buttonText: "Sign In", showForgotPassword: config.enableRecovery, onForgotPassword: onForgotPassword })), isFederated === false && isTraditional === false && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)(FederatedAuthSection_1.FederatedAuthSection, { providers: config.providers, onProviderClick: handleFederatedClick, isLoading: totalLoading }), config.providers.length > 0 && ((0, jsx_runtime_1.jsxs)("div", { className: "relative my-6", children: [(0, jsx_runtime_1.jsx)("div", { className: "absolute inset-0 flex items-center", children: (0, jsx_runtime_1.jsx)("div", { className: "w-full", style: {
-                                        borderTop: '1px solid var(--border-default)',
-                                    } }) }), (0, jsx_runtime_1.jsx)("div", { className: "relative flex justify-center text-sm", children: (0, jsx_runtime_1.jsx)("span", { className: "px-2", style: {
-                                        background: 'var(--bg-card)',
-                                        color: 'var(--text-secondary)',
-                                    }, children: "Or sign in with email" }) })] })), (0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: setEmail, onPasswordChange: setPassword, onSubmit: handleTraditionalSubmit, isLoading: totalLoading, buttonText: "Sign In", showForgotPassword: config.enableRecovery, onForgotPassword: onForgotPassword })] }))] }));
+                }, children: error })), isFederated && ((0, jsx_runtime_1.jsx)(FederatedAuthSection_1.FederatedAuthSection, { providers: config.providers, onProviderClick: handleFederatedClick, isLoading: totalLoading })), isFederated && isTraditional && ((0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-3 my-6", "aria-hidden": "true", children: [(0, jsx_runtime_1.jsx)("span", { className: "h-px flex-1", style: { background: 'var(--border-default, #e5e7eb)' } }), (0, jsx_runtime_1.jsx)("span", { className: "text-xs uppercase tracking-wide", style: { color: 'var(--text-muted, #6b7280)' }, children: "or" }), (0, jsx_runtime_1.jsx)("span", { className: "h-px flex-1", style: { background: 'var(--border-default, #e5e7eb)' } })] })), isTraditional && ((0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: setEmail, onPasswordChange: setPassword, onSubmit: handleTraditionalSubmit, isLoading: totalLoading, buttonText: "Sign In", showForgotPassword: config.enableRecovery, onForgotPassword: onForgotPassword })), !isFederated && !isTraditional && ((0, jsx_runtime_1.jsxs)("div", { role: "alert", className: "px-4 py-3 rounded-lg text-sm text-left", style: {
+                    border: '1px solid var(--border-default, #e5e7eb)',
+                    color: 'var(--text-primary, #111827)',
+                }, children: [(0, jsx_runtime_1.jsx)("p", { className: "font-semibold", children: "Sign-in is not available for this application." }), (0, jsx_runtime_1.jsx)("p", { className: "mt-1", children: "No sign-in method is enabled for this client. An administrator needs to enable a federated provider or username and password sign-in." })] }))] }));
 }

package/dist/components/auth/ModeAwareSignupPage.js

@@ -31,8 +31,11 @@ function ModeAwareSignupPage({ onFederatedSignUp, onTraditionalSignUp, isLoading
             setLocalLoading(false);
         }
     };
-    const isFederated = config.mode === 'federated';
-    const isTraditional = config.mode === 'traditional';
+    // Same change as ModeAwareLoginPage: read the independent flags, not the single mode.
+    // Leaving signup on `mode` would have made sign-in and sign-up disagree about what the
+    // client offers - the worse half of a half-migration.
+    const isFederated = config.allowFederatedLogin !== false && config.providers.length > 0;
+    const isTraditional = config.allowTraditionalLogin !== false;
     const totalLoading = isLoading || localLoading;
     return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [error && ((0, jsx_runtime_1.jsx)("div", { className: "mb-6 px-4 py-3 rounded-lg", style: {
                     background: 'var(--color-error, #ef4444)',

package/dist/components/auth/TraditionalAuthSection.js

@@ -4,7 +4,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TraditionalAuthSection = TraditionalAuthSection;
 const jsx_runtime_1 = require("react/jsx-runtime");
 function TraditionalAuthSection({ email, password, onEmailChange, onPasswordChange, onSubmit, isLoading, buttonText = 'Sign In', showForgotPassword = true, onForgotPassword, }) {
-    return ((0, jsx_runtime_1.jsxs)("form", { onSubmit: onSubmit, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary)' }, children: "Email Address" }), (0, jsx_runtime_1.jsx)("input", { type: "email", value: email, onChange: (e) => onEmailChange(e.target.value), placeholder: "you@example.com", disabled: isLoading, required: true, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: {
+    // text-left is DELIBERATE and load-bearing: a host card with text-align:center made the
+    // Email label render CENTRED while Password stayed left, because Password sits in a flex
+    // row (for the forgot link) that ignores inherited alignment and Email did not. A shared
+    // component must not inherit its alignment from whatever wraps it.
+    return ((0, jsx_runtime_1.jsxs)("form", { onSubmit: onSubmit, className: "space-y-4 text-left", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary)' }, children: "Email Address" }), (0, jsx_runtime_1.jsx)("input", { type: "email", value: email, onChange: (e) => onEmailChange(e.target.value), placeholder: "you@example.com", disabled: isLoading, required: true, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: {
                             border: '1px solid var(--border-default)',
                             color: 'var(--text-primary)',
                             background: 'var(--bg-default)',