@protobase/server 0.66.5 → 0.66.7

package/dist/app-pool.d.ts

@@ -34,9 +34,11 @@ export type PgModule<P extends PgPool> = {
  * runtime's, which `protobase dev` and `serve` open, and the one the app's own code uses, such as its Better Auth store.
  * Whoever asks first opens it, and everyone in the process shares it, across a dev server's reloads too, until it ends;
  * so the app never opens more connections than it may. Date and timestamp (without zone) come back as text, which the
- * API formats itself, a dropped connection is printed rather than fatal, and a query waits at most `poolWaitMs` for a
- * free connection. Idle connections keep no process alive, so a command exits when its work is done even while
- * nobody ends the pool, such as one that sent no query of its own after Better Auth's schema check.
+ * API formats itself, a dropped connection is printed rather than fatal, and a new connection may take `connectTimeoutMs`
+ * to open, as long as a database takes to wake. A query that finds every connection in use waits at most `poolWaitMs`
+ * for one where the runtime connects (`connectOrBusy`), and `connectTimeoutMs` elsewhere. Idle connections keep no
+ * process alive, so a command exits when its work is done even while nobody ends the pool, such as one that sent no
+ * query of its own after Better Auth's schema check.
  */
 export declare const appPool: <P extends PgPool>(pg: PgModule<P>, url: string, max?: number) => P;
 /**

package/dist/app-pool.js

@@ -3,6 +3,11 @@ import { handleDroppedConnections } from "./dropped-connections.js";
 //#region src/app-pool.ts
 /** How long a query waits for a free connection of the app's pool before it fails with `ConnectionsBusy`. */
 const poolWaitMs = 2e3;
+/**
+* How long the app's pool waits for a new connection to open: long enough for a database that scaled to zero to wake,
+* which the platform's pooler holds the login for, and under that pooler's own login timeout (60 s by default).
+*/
+const connectTimeoutMs = 3e4;
 /** How many connections the app's pool opens: `PROTOBASE_DB_CONNECTIONS`, such as its plan's limit, or 10. */
 const readDbConnections = (env) => {
 	if (!env.PROTOBASE_DB_CONNECTIONS) return 10;
@@ -17,9 +22,11 @@ const store = globalThis;
 * runtime's, which `protobase dev` and `serve` open, and the one the app's own code uses, such as its Better Auth store.
 * Whoever asks first opens it, and everyone in the process shares it, across a dev server's reloads too, until it ends;
 * so the app never opens more connections than it may. Date and timestamp (without zone) come back as text, which the
-* API formats itself, a dropped connection is printed rather than fatal, and a query waits at most `poolWaitMs` for a
-* free connection. Idle connections keep no process alive, so a command exits when its work is done even while
-* nobody ends the pool, such as one that sent no query of its own after Better Auth's schema check.
+* API formats itself, a dropped connection is printed rather than fatal, and a new connection may take `connectTimeoutMs`
+* to open, as long as a database takes to wake. A query that finds every connection in use waits at most `poolWaitMs`
+* for one where the runtime connects (`connectOrBusy`), and `connectTimeoutMs` elsewhere. Idle connections keep no
+* process alive, so a command exits when its work is done even while nobody ends the pool, such as one that sent no
+* query of its own after Better Auth's schema check.
 */
 const appPool = (pg, url, max = readDbConnections(globalThis.process?.env ?? {})) => {
 	const pools = store.__protobaseAppPools ??= /* @__PURE__ */ new Map();
@@ -32,7 +39,7 @@ const appPool = (pg, url, max = readDbConnections(globalThis.process?.env ?? {})
 	const pool = handleDroppedConnections(new pg.Pool({
 		connectionString: url,
 		max,
-		connectionTimeoutMillis: poolWaitMs,
+		connectionTimeoutMillis: connectTimeoutMs,
 		allowExitOnIdle: true,
 		types: textDates(pg)
 	}));
@@ -57,4 +64,4 @@ const longQueryPool = (pg, url) => handleDroppedConnections(new pg.Pool({
 	types: textDates(pg)
 }));
 //#endregion
-export { appPool, longQueryPool, poolWaitMs, readDbConnections };
+export { appPool, connectTimeoutMs, longQueryPool, poolWaitMs, readDbConnections };

package/dist/assistant/delete-record-tool.d.ts

@@ -1,6 +1,6 @@
 import { AssistantTool, ToolContext } from "./tools.js";
 import { WriteRecordToolsInput } from "./write-tool-limits.js";
 //#region src/assistant/delete-record-tool.d.ts
-/** Deletes one record by its key and ETag once the user approves it, under the caller's access rules. */
+/** Deletes one record by its key, and its ETag when given, once the user approves it, under the caller's access rules. */
 export declare const deleteRecordTool: (input?: WriteRecordToolsInput) => AssistantTool<ToolContext>;
 //#endregion

package/dist/assistant/delete-record-tool.js

@@ -21,12 +21,15 @@ const deleteKeyOf = (value) => {
 	if (key === void 0) return void 0;
 	return (Array.isArray(key) ? key : [key]).every(keyPartOk) ? key : void 0;
 };
-const etagOf = (value) => typeof value === "string" && /^"[\x21\x23-\x2b\x2d-\x7e]+"$/.test(value) ? value : void 0;
-const usage = "Pass only the resource, key and etag as { \"resource\": \"<name>\", \"key\": \"<key>\", \"etag\": \"<the etag get_record gave>\" }; nothing was deleted.";
-/** Deletes one record by its key and ETag once the user approves it, under the caller's access rules. */
+const etagOf = (value) => {
+	if (value === void 0 || value === "*") return { etag: value };
+	return typeof value === "string" && /^"[\x21\x23-\x2b\x2d-\x7e]+"$/.test(value) ? { etag: value } : false;
+};
+const usage = "Pass only the resource, key and, optionally, etag as { \"resource\": \"<name>\", \"key\": \"<key>\", \"etag\": \"<the etag get_record gave>\" }; nothing was deleted.";
+/** Deletes one record by its key, and its ETag when given, once the user approves it, under the caller's access rules. */
 const deleteRecordTool = (input = {}) => defineTool({
 	name: "delete_record",
-	description: `Deletes one record of a resource by its key. Pass the etag get_record gave: it fails when someone changed the record since. A resource that soft deletes keeps the record, deleted; any other loses it for good. The user approves each delete in their client first; nothing is deleted without it.${onlyNote(input)}`,
+	description: `Deletes one record of a resource by its key. Pass the etag get_record gave to fail when someone changed the record since; without one, or with *, it deletes the record whatever its version. A resource that soft deletes keeps the record, deleted; any other loses it for good. The user approves each delete in their client first; nothing is deleted without it.${onlyNote(input)}`,
 	parameters: {
 		type: "object",
 		properties: {
@@ -37,11 +40,7 @@ const deleteRecordTool = (input = {}) => defineTool({
 				description: "The etag get_record gave, to fail when the record changed since."
 			}
 		},
-		required: [
-			"resource",
-			"key",
-			"etag"
-		],
+		required: ["resource", "key"],
 		additionalProperties: false
 	},
 	annotations: {
@@ -52,12 +51,13 @@ const deleteRecordTool = (input = {}) => defineTool({
 	run: async (args, context) => {
 		const resource = resourceOf(args);
 		const key = deleteKeyOf(args.key);
-		const etag = etagOf(args.etag);
-		if (!resource || key === void 0 || !etag || Object.keys(args).some((name) => !parameterNames.includes(name))) return usage;
+		const given = etagOf(args.etag);
+		if (!resource || key === void 0 || !given || Object.keys(args).some((name) => !parameterNames.includes(name))) return usage;
 		const refusal = outside(input, resource);
 		if (refusal) return refusal;
 		const softDelete = await context.records.softDeleteField(resource).then((field) => ({ field }), refused);
 		if (typeof softDelete === "string") return softDelete;
+		const { etag } = given;
 		const before = await recordBefore(context, resource, key, etag);
 		if (typeof before === "string") return before;
 		const { text, described } = await approvalTexts(context, resource);

package/dist/better-auth/auth-mail/auth-emails.d.ts

@@ -2,6 +2,7 @@ import "./account-exists-email.js";
 import "./change-email-code-email.js";
 import "./invitation-email.js";
 import "./no-account-email.js";
+import "./password-changed-email.js";
 import "./reset-password-email.js";
 import "./sign-in-code-email.js";
 import "./sign-up-code-email.js";

package/dist/better-auth/auth-mail/auth-emails.js

@@ -2,9 +2,10 @@ import { accountExistsEmail } from "./account-exists-email.js";
 import { changeEmailCodeEmail } from "./change-email-code-email.js";
 import { invitationEmail } from "./invitation-email.js";
 import { noAccountEmail } from "./no-account-email.js";
+import { passwordChangedEmail } from "./password-changed-email.js";
 import { resetPasswordEmail } from "./reset-password-email.js";
 import { signInCodeEmail } from "./sign-in-code-email.js";
 import { signUpCodeEmail } from "./sign-up-code-email.js";
 import { staffSignInEmail } from "./staff-sign-in-email.js";
 import { twoFactorCodeEmail } from "./two-factor-code-email.js";
-export { accountExistsEmail, changeEmailCodeEmail, invitationEmail, noAccountEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };
+export { accountExistsEmail, changeEmailCodeEmail, invitationEmail, noAccountEmail, passwordChangedEmail, resetPasswordEmail, signInCodeEmail, signUpCodeEmail, staffSignInEmail, twoFactorCodeEmail };

package/dist/better-auth/auth-mail/password-changed-email.d.ts

@@ -0,0 +1 @@
+import "../../index.js";

package/dist/better-auth/auth-mail/password-changed-email.js

@@ -0,0 +1,32 @@
+import { defineEmail } from "../../mail/define-email.js";
+import { EmailButton, EmailLayout, EmailNote } from "../../mail/email-layout.js";
+import { signInPath } from "@protobase/schema";
+import { Text } from "react-email";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/better-auth/auth-mail/password-changed-email.tsx
+const PasswordChangedEmail = ({ app }) => /* @__PURE__ */ jsxs(EmailLayout, {
+	app,
+	preview: `The password of your ${app.name} account was changed`,
+	heading: "Your password was changed",
+	children: [
+		/* @__PURE__ */ jsxs(Text, { children: [
+			"The password of your account with ",
+			app.name,
+			" was just changed."
+		] }),
+		/* @__PURE__ */ jsx(Text, { children: "If this was not you, choose a new password at once with \"Forgot password?\" on the sign-in page:" }),
+		/* @__PURE__ */ jsx(EmailButton, {
+			href: new URL(signInPath({ step: "forgot-password" }), app.url).href,
+			children: "Choose a new password"
+		}),
+		/* @__PURE__ */ jsx(EmailNote, { children: "If this was you, ignore this email." })
+	]
+});
+/** The email to an account whose password changed: what happened, and how to take the account back if it was not them. */
+const passwordChangedEmail = defineEmail({
+	name: "password-changed",
+	subject: ({ app }) => `Your ${app.name} password was changed`,
+	component: PasswordChangedEmail
+});
+//#endregion
+export { passwordChangedEmail };

package/dist/better-auth/auth-settings.d.ts

@@ -1009,8 +1009,8 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
-                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                readonly user?: ("list" | "create" | "update" | "delete" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;
@@ -4463,6 +4463,14 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-password-checks";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-set-password";
     endpoints: {
@@ -4498,6 +4506,32 @@ export declare const buildAppAuth: (settings: AuthSettings, input: AppAuthInput)
         status: boolean;
       }>;
     };
+  } | {
+    id: "protobase-password-change";
+    endpoints: {
+      passwordChanged: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          context: {
+            body: any;
+          };
+        } | undefined>>;
+      }[];
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-leaked-passwords";
     hooks: {

package/dist/better-auth/create-auth.d.ts

@@ -1141,8 +1141,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           $Infer: {
             body: {
               permissions: {
-                readonly user?: ("create" | "update" | "delete" | "list" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
-                readonly session?: ("delete" | "list" | "revoke")[] | undefined;
+                readonly user?: ("list" | "create" | "update" | "delete" | "set-role" | "ban" | "impersonate" | "set-password" | "set-email" | "get" | "impersonate-admins")[] | undefined;
+                readonly session?: ("list" | "delete" | "revoke")[] | undefined;
               };
             } & {
               userId?: string | undefined;
@@ -2914,7 +2914,10 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
           email: string;
           emailVerified: boolean;
           name: string;
-          image?: string | null | undefined;
+          image? /**
+           * The secrets the app had before `secret`, newest first, such as `PROTOBASE_PREVIOUS_SECRETS`: what they encrypted
+           * still decrypts, so the signing keys keep signing after the secret changes. Default none.
+           */ : string | null | undefined;
         } & Record<string, any>;
       } | {
         status: boolean;
@@ -3099,7 +3102,11 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               email: string;
               emailVerified: boolean;
               name: string;
-              image?: string | null | undefined;
+              image? /**
+               * Refuses a new password that appears in a known data breach, by Have I Been Pwned's password list: at sign-up, from
+               * an invitation, and when a password is set, changed, reset or given by an admin. Only the first five characters of
+               * the password's SHA-1 hash leave the server. While the list cannot be reached, setting a password fails. Default off.
+               */ : string | null | undefined;
             };
           };
         }>>[];
@@ -4117,7 +4124,9 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               expiresAt: Date;
               token: string;
               ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
+              userAgent?
+              /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
+              /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */ : string | null | undefined;
             };
             user: Record<string, any> & {
               id: string;
@@ -4591,6 +4600,14 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
       }[];
     };
+  } | {
+    id: "protobase-password-checks";
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-set-password";
     endpoints: {
@@ -4626,6 +4643,32 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         status: boolean;
       }>;
     };
+  } | {
+    id: "protobase-password-change";
+    endpoints: {
+      passwordChanged: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        body: import("zod").ZodObject<{
+          email: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        status: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          context: {
+            body: any;
+          };
+        } | undefined>>;
+      }[];
+      after: {
+        matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
   } | {
     id: "protobase-leaked-passwords";
     hooks: {
@@ -5091,7 +5134,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
         member: import("better-auth/plugins").Member & Record<string, any>;
       }) => Promise<void | {
         data: {
-          name?: string;
+          name? /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */ : string;
           slug?: string;
           logo?: string | null;
           metadata?: Record<string, any>;
@@ -8968,7 +9011,8 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
 }> & {
   /**
    * Answers a request from the app's iOS or Android build: Better Auth also trusts the Capacitor origin the request
-   * names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
+   * names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin. A
+   * Capacitor origin's POST without a JSON body is refused before it is granted, as only a page sends one.
    */
   handleMobile: (request: Request) => Promise<Response>;
   /**

package/dist/better-auth/create-auth.js

@@ -13,13 +13,14 @@ import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { authLogger } from "./auth-logger.js";
 import { cookiePrefixOf } from "./cookie-prefix.js";
-import { mobileRequests } from "./mobile-requests.js";
+import { jsonOnlyOnMobile, mobileRequests } from "./mobile-requests.js";
 import { passwordLength } from "./new-account-password.js";
 import { platformMailer } from "../mail/platform-mailer.js";
 import { readOperatorSettings, resolveOperator } from "./operator-provider.js";
 import { defaultInvitationUrl } from "./invitations/invitation-link-hook.js";
 import { lastAdminGuardPlugin } from "./last-admin-guard.js";
 import { setPasswordPath, setPasswordPlugin } from "./set-password.js";
+import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { signUpPaths, signUpPlugin } from "./sign-up/sign-up-plugin.js";
 import { leakedPasswordsPlugin } from "./leaked-passwords.js";
 import { lockedAccountsPlugin, readLockedAccounts } from "./locked-accounts.js";
@@ -35,6 +36,8 @@ import { passkeyHosts, readPasskeyDomain, resolvePasskeyDomain } from "./passkey
 import { coreNames, pluginNames } from "./snake-case-names.js";
 import { passkeyPlugin } from "./passkey-plugin.js";
 import { passwordResetOptions } from "./password-reset.js";
+import { mailPasswordChanged, passwordChangePlugin } from "./password-change.js";
+import { passwordChecksPlugin } from "./password-checks.js";
 import { rolesPlugin } from "./roles/roles-plugin.js";
 import { versionedSecrets } from "./secret-versions.js";
 import { signingKeyRotation, signingKeys } from "./signing-keys.js";
@@ -43,7 +46,6 @@ import { appSignInPolicy } from "./app-sign-in-policy.js";
 import { assertNoEndpointKeyClashes } from "./endpoint-key-clashes.js";
 import { emailInDomains, resolveSamlProviders, samlDisabledPaths, samlGuardPlugin } from "./saml-sign-in.js";
 import { noAccountMailPlugin } from "./no-account-mail.js";
-import { emailCodeOptions, twoFactorCodeOptions, unusedEmailCodePaths } from "./sign-in-mail.js";
 import { confirmedOnCreate, confirmedOnUpdate, emailConfirmedField } from "./email-confirmed.js";
 import { rehashPasswordsPlugin, verifyAcceptedHash } from "./password-hashes.js";
 import { staffSignInPlugin } from "./staff-plugin.js";
@@ -177,7 +179,11 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			minPasswordLength: passwordLength.min,
 			maxPasswordLength: passwordLength.max,
 			...passwordHashes.length > 0 && { password: { verify: verifyAcceptedHash(passwordHashes) } },
-			...mail && passwordResetOptions(mail, mcp ? { onPasswordReset: async ({ user }) => revokeMcpGrants((await context()).adapter, user.id) } : {})
+			...mail && passwordResetOptions(mail, { onPasswordReset: async ({ user }) => {
+				const auth = await context();
+				if (mcp) await revokeMcpGrants(auth.adapter, user.id);
+				await mailPasswordChanged({ context: auth }, mail, user.email);
+			} })
 		},
 		...options.socialProviders && { socialProviders: options.socialProviders },
 		user: {
@@ -222,7 +228,9 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
 			...saml.length > 0 ? [loaded(plugins.samlPlugin, "sso.saml")(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
+			passwordChecksPlugin(),
 			setPasswordPlugin(),
+			passwordChangePlugin(mail),
 			...options.leakedPasswords ? [leakedPasswordsPlugin()] : [],
 			goTrueSessionsPlugin({
 				issuer: goTrueIssuer(options.baseURL),
@@ -412,9 +420,10 @@ const createAuth = (options, plugins = {}) => {
 	return Object.assign(auth, {
 		/**
 		* Answers a request from the app's iOS or Android build: Better Auth also trusts the Capacitor origin the request
-		* names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin.
+		* names. Only `createAdmin` with a `mobile` section uses it; `handler` and `api` never trust a Capacitor origin. A
+		* Capacitor origin's POST without a JSON body is refused before it is granted, as only a page sends one.
 		*/
-		handleMobile: (request) => auth.handler(mobile.grant(request)),
+		handleMobile: async (request) => jsonOnlyOnMobile(request) ?? auth.handler(mobile.grant(request)),
 		/**
 		* What runs when a user is deleted: `set` a named listener that removes what the app keeps of the user elsewhere,
 		* such as their devices; `run` is for a deletion outside Better Auth's endpoints (`deleteUser`).

package/dist/better-auth/mcp/revoke-grants.js

@@ -28,7 +28,11 @@ const revokeMcpGrants = async (adapter, userId, clientId) => {
 		where
 	});
 };
-const ownPaths = ["/revoke-sessions", "/revoke-other-sessions"];
+const ownPaths = [
+	"/revoke-sessions",
+	"/revoke-other-sessions",
+	"/change-password"
+];
 const adminPaths = [
 	"/admin/revoke-user-sessions",
 	"/admin/ban-user",
@@ -42,14 +46,14 @@ const securesAccount = (data) => {
 };
 /**
 * The user whose MCP grants a finished request ends, or `undefined`: the person who signed out everywhere, signed out
-* their other devices, or changed their password signing out the other devices; the user an admin ended the sessions
+* their other devices, or changed their password; the user an admin ended the sessions
 * of, banned, set the password of, or marked unverified. Nobody when the request failed.
 */
 const grantOwnerToRevoke = (request) => {
 	const { path, context } = request;
 	if (context.returned instanceof Error || path === void 0) return void 0;
 	const body = bodyOf(request);
-	if (ownPaths.includes(path) || path === "/change-password" && body.revokeOtherSessions === true) return context.session?.user.id;
+	if (ownPaths.includes(path)) return context.session?.user.id;
 	if (adminPaths.includes(path) || path === "/admin/update-user" && securesAccount(body.data)) return body.userId === void 0 ? void 0 : String(body.userId);
 };
 /**
@@ -62,7 +66,6 @@ const mcpGrantRevocation = () => ({
 		matcher: (context) => context.path !== void 0 && [
 			...ownPaths,
 			...adminPaths,
-			"/change-password",
 			"/admin/update-user"
 		].includes(context.path),
 		handler: createAuthMiddleware(async (ctx) => {

package/dist/better-auth/mobile-requests.js

@@ -1,5 +1,9 @@
 import { capacitorOrigins } from "../mobile-config.js";
 //#region src/better-auth/mobile-requests.ts
+const capacitorOriginOf = (request) => {
+	const origin = request.headers.get("origin");
+	return origin !== null && capacitorOrigins.includes(origin);
+};
 /**
 * Which requests come from the app's iOS or Android build: `grant` marks a request, and `trusted` gives the Capacitor
 * origin it names as an origin Better Auth trusts, for that very request only. Any other request, or an Origin that is
@@ -14,10 +18,26 @@ const mobileRequests = () => {
 		},
 		trusted: (request) => {
 			if (!request || !granted.has(request)) return [];
-			const origin = request.headers.get("origin");
-			return origin !== null && capacitorOrigins.includes(origin) ? [origin] : [];
+			return capacitorOriginOf(request) ? [request.headers.get("origin")] : [];
 		}
 	};
 };
+const mediaType = (request) => request.headers.get("content-type")?.split(";")[0].trim().toLowerCase();
+/**
+* Refuses a POST from a Capacitor origin whose body is not JSON. A page can send a form, `text/plain` or multipart POST
+* without a preflight, but not a JSON one, and `/api/auth` answers no preflight: so the grant only ever sees requests
+* the app's native HTTP sends. A request from any other origin is left alone, such as an identity provider's form POST.
+*/
+const jsonOnlyOnMobile = (request) => {
+	if (request.method !== "POST" || !capacitorOriginOf(request)) return;
+	if (mediaType(request) === "application/json") return;
+	return new Response(JSON.stringify({
+		message: "A request from the app takes a JSON body only",
+		code: "UNSUPPORTED_MEDIA_TYPE"
+	}), {
+		status: 415,
+		headers: { "content-type": "application/json" }
+	});
+};
 //#endregion
-export { mobileRequests };
+export { jsonOnlyOnMobile, mobileRequests };

package/dist/better-auth/password-change.js

@@ -0,0 +1,68 @@
+import { setPasswordPath } from "./set-password.js";
+import { sendAuthEmail } from "./auth-mail/send-auth-email.js";
+import * as z$1 from "zod";
+import { APIError, createAuthEndpoint, createAuthMiddleware } from "better-auth/api";
+//#region src/better-auth/password-change.ts
+/**
+* Mails `email` that its account's password changed, when the app has mail: in the background, as Better Auth sends
+* its own mail, so the answer does not wait on the mail server.
+*/
+const mailPasswordChanged = async (ctx, mail, email) => {
+	if (!mail) return;
+	await ctx.context.runInBackgroundOrAwait(sendAuthEmail(mail, "passwordChangedEmail", email, {}, ctx.context.baseURL));
+};
+const ownChanges = ["/change-password", setPasswordPath];
+const adminChange = "/admin/set-user-password";
+/** Whose account a finished request gave a new password: the address of the person, or the id of the user an admin set it for. */
+const changedAccount = ({ path, body, context }) => {
+	if (context.returned instanceof Error || path === void 0) return;
+	if (ownChanges.includes(path)) return context.session ? { email: context.session.user.email } : void 0;
+	const userId = typeof body === "object" && body !== null ? body.userId : void 0;
+	if (path === adminChange && userId !== void 0) return { userId: String(userId) };
+};
+/**
+* A password change ends the account's other sessions and tells its owner:
+* - `/change-password` always signs out the other devices, whatever `revokeOtherSessions` says: this device gets a
+*   new session, and the MCP grant revocation disconnects the account's MCP clients.
+* - When the app has mail, the owner is emailed after `/change-password`, a first password (`/account/set-password`)
+*   and an admin's `/admin/set-user-password`; `passwordChanged` mails them for a change outside these endpoints,
+*   such as the GoTrue-compatible `PUT /user`. A password reset mails them from `onPasswordReset`.
+*/
+const passwordChangePlugin = (mail) => ({
+	id: "protobase-password-change",
+	endpoints: { passwordChanged: createAuthEndpoint.serverOnly({
+		method: "POST",
+		body: z$1.object({ email: z$1.string() })
+	}, async (ctx) => {
+		await mailPasswordChanged(ctx, mail, ctx.body.email);
+		return ctx.json({ status: true });
+	}) },
+	hooks: {
+		before: [{
+			matcher: (ctx) => ctx.path === "/change-password",
+			handler: createAuthMiddleware(async (ctx) => {
+				if (typeof ctx.body !== "object" || ctx.body === null) return;
+				return { context: { body: {
+					...ctx.body,
+					revokeOtherSessions: true
+				} } };
+			})
+		}],
+		after: [{
+			matcher: (ctx) => ctx.path !== void 0 && [...ownChanges, adminChange].includes(ctx.path),
+			handler: createAuthMiddleware(async (ctx) => {
+				const changed = changedAccount(ctx);
+				if (!changed || !mail) return;
+				if ("email" in changed) {
+					await mailPasswordChanged(ctx, mail, changed.email);
+					return;
+				}
+				const user = await ctx.context.internalAdapter.findUserById(changed.userId);
+				if (!user) throw new APIError("NOT_FOUND", { message: "The user whose password was set is gone" });
+				await mailPasswordChanged(ctx, mail, user.email);
+			})
+		}]
+	}
+});
+//#endregion
+export { changedAccount, mailPasswordChanged, passwordChangePlugin };

package/dist/better-auth/password-checks.js

@@ -0,0 +1,69 @@
+import { APIError, createAuthMiddleware, getSessionFromCtx } from "better-auth/api";
+const maxTrackedAccounts = 1e4;
+const checkedFields = {
+	"/change-password": "currentPassword",
+	"/verify-password": "password",
+	"/delete-user": "password",
+	"/two-factor/enable": "password",
+	"/two-factor/disable": "password",
+	"/two-factor/get-totp-uri": "password",
+	"/two-factor/generate-backup-codes": "password"
+};
+/**
+* Counts the checks of each account in a fixed window that opens at its first check: `take` answers how many seconds
+* the account waits before its next check, or `undefined` when this one may go ahead and is counted. Bounded: a window
+* that ended is dropped, and at `maxTracked` accounts the oldest window is dropped.
+*/
+const checkCounter = ({ max, windowSeconds, maxTracked = maxTrackedAccounts, now = Date.now }) => {
+	const windows = /* @__PURE__ */ new Map();
+	const windowMs = windowSeconds * 1e3;
+	const prune = (at) => {
+		for (const [key, window] of windows) if (at - window.opened >= windowMs) windows.delete(key);
+		while (windows.size >= maxTracked) windows.delete(windows.keys().next().value);
+	};
+	return { take: (key) => {
+		const at = now();
+		const window = windows.get(key);
+		if (window && at - window.opened < windowMs) {
+			if (window.count >= max) return Math.ceil((window.opened + windowMs - at) / 1e3);
+			window.count += 1;
+			return;
+		}
+		windows.delete(key);
+		prune(at);
+		windows.set(key, {
+			opened: at,
+			count: 1
+		});
+	} };
+};
+/**
+* Limits the current-password checks behind a session to `passwordChecksPerWindow` an account a minute, on top of
+* Better Auth's limit per client address, so a stolen session cannot guess the password from many addresses. Every
+* check counts, a right one too, and is counted before the password is compared, so requests sent at once cannot pass
+* the limit together. A refused check answers `429 TOO_MANY_PASSWORD_CHECKS`, with `X-Retry-After` in seconds. A
+* request without a session is left to the endpoint, which refuses it. The count lives in this process's memory.
+*/
+const passwordChecksPlugin = (counter = checkCounter({
+	max: 5,
+	windowSeconds: 60
+})) => ({
+	id: "protobase-password-checks",
+	hooks: { before: [{
+		matcher: (ctx) => ctx.path !== void 0 && Object.hasOwn(checkedFields, ctx.path),
+		handler: createAuthMiddleware(async (ctx) => {
+			const password = ctx.body?.[checkedFields[ctx.path]];
+			if (typeof password !== "string" || password === "") return;
+			const session = await getSessionFromCtx(ctx);
+			if (!session) return;
+			const wait = counter.take(session.user.id);
+			if (wait === void 0) return;
+			throw new APIError("TOO_MANY_REQUESTS", {
+				code: "TOO_MANY_PASSWORD_CHECKS",
+				message: "Too many password attempts. Try again in a minute."
+			}, { "X-Retry-After": String(wait) });
+		})
+	}] }
+});
+//#endregion
+export { checkCounter, passwordChecksPlugin };