better-auth 1.2.4-beta.1 → 1.2.4-beta.12

package/dist/shared/{better-auth.GgQnT00n.cjs → better-auth.CHHC_PJT.cjs}

@@ -82,6 +82,7 @@ async function parseState(c) {
     parsedData.errorURL = `${c.context.baseURL}/error`;
   }
   if (parsedData.expiresAt < Date.now()) {
+    await c.context.internalAdapter.deleteVerificationValue(data.id);
     throw c.redirect(
       `${c.context.baseURL}/error?error=please_restart_the_process`
     );

package/dist/shared/{better-auth.BI_ldOv7.mjs → better-auth.CHsl8t-G.mjs}

@@ -1,11 +1,11 @@
 import { APIError } from 'better-call';
 import { z } from 'zod';
-import { a as createAuthEndpoint, g as getSessionFromCtx } from './better-auth.npe3WWSD.mjs';
+import { a as createAuthEndpoint, g as getSessionFromCtx } from './better-auth.CFZLHBFT.mjs';
 import './better-auth.8zoxzg-F.mjs';
 import '@better-auth/utils/base64';
 import '@better-auth/utils/hmac';
 import './better-auth.C24Bzw4w.mjs';
-import { u as updateMemberRole, a as addMember, c as createInvitation, g as getFullOrganization, s as setActiveOrganization, b as createTeam, d as updateTeam, r as removeTeam, l as listOrganizationTeams, e as leaveOrganization, f as getActiveMember, h as removeMember, i as checkOrganizationSlug, j as rejectInvitation, k as getInvitation, m as acceptInvitation, n as cancelInvitation, o as listOrganizations, p as deleteOrganization, q as updateOrganization, t as createOrganization, O as ORGANIZATION_ERROR_CODES, v as orgSessionMiddleware, w as getOrgAdapter, x as hasPermission } from './better-auth.CqfKuHli.mjs';
+import { u as updateMemberRole, a as addMember, c as createInvitation, g as getFullOrganization, s as setActiveOrganization, b as createTeam, d as updateTeam, r as removeTeam, l as listOrganizationTeams, e as leaveOrganization, f as getActiveMember, h as removeMember, i as checkOrganizationSlug, j as rejectInvitation, k as getInvitation, m as acceptInvitation, n as cancelInvitation, o as listOrganizations, p as deleteOrganization, q as updateOrganization, t as createOrganization, O as ORGANIZATION_ERROR_CODES, v as orgSessionMiddleware, w as getOrgAdapter, x as hasPermission } from './better-auth.CmplT_y7.mjs';
 import { defaultRoles } from '../plugins/organization/access/index.mjs';
 
 const shimContext = (originalObject, newContext) => {
@@ -164,11 +164,6 @@ const organization = (options) => {
           }
         },
         async (ctx) => {
-          if (!ctx.body.permission || Object.keys(ctx.body.permission).length > 1) {
-            throw new APIError("BAD_REQUEST", {
-              message: "invalid permission check. you can only check one resource permission at a time."
-            });
-          }
           const activeOrganizationId = ctx.body.organizationId || ctx.context.session.session.activeOrganizationId;
           if (!activeOrganizationId) {
             throw new APIError("BAD_REQUEST", {

package/dist/shared/{better-auth.BAR_8WbD.d.cts → better-auth.CPKTEzG-.d.cts}

@@ -85,7 +85,7 @@ declare const createInternalAdapter: (adapter: Adapter, ctx: {
     updateSession: (sessionToken: string, session: Partial<Session> & Record<string, any>, context?: GenericEndpointContext) => Promise<any>;
     deleteSession: (token: string) => Promise<void>;
     deleteAccounts: (userId: string) => Promise<void>;
-    deleteAccount: (providerId: string, userId: string) => Promise<void>;
+    deleteAccount: (accountId: string) => Promise<void>;
     deleteSessions: (userIdOrSessionTokens: string | string[]) => Promise<void>;
     findOAuthUser: (email: string, accountId: string, providerId: string) => Promise<{
         user: {
@@ -666,6 +666,7 @@ type EligibleCookies = (string & {}) | (keyof BetterAuthCookies & {});
 declare const getSessionCookie: (request: Request | Headers, config?: {
     cookiePrefix?: string;
     cookieName?: string;
+    useSecureCookies?: boolean;
 }) => string | null;
 declare const getCookieCache: <Session extends {
     session: Session & Record<string, any>;
@@ -2588,7 +2589,7 @@ type BetterAuthOptions = {
     /**
      * List of trusted origins.
      */
-    trustedOrigins?: string[] | ((request: Request) => string[]);
+    trustedOrigins?: string[] | ((request: Request) => string[] | Promise<string[]>);
     /**
      * Rate limiting configuration
      */

package/dist/shared/{better-auth.DXbPkpEx.cjs → better-auth.CR_ASYNx.cjs}

@@ -2,7 +2,7 @@
 
 const zod = require('zod');
 const betterCall = require('better-call');
-const account = require('./better-auth.BzKRBwSF.cjs');
+const account = require('./better-auth.GVCiTzec.cjs');
 const cookies_index = require('../cookies/index.cjs');
 const schema$1 = require('./better-auth.CHyZMcYK.cjs');
 require('./better-auth.DiSjtgs9.cjs');
@@ -51,7 +51,7 @@ const admin = (options) => {
   };
   const adminMiddleware = account.createAuthMiddleware(async (ctx) => {
     const session = await account.getSessionFromCtx(ctx);
-    if ((!session?.session || !opts.adminRoles.includes(session.user.role)) && !opts.adminUserIds?.includes(session?.user.id || "")) {
+    if (!session) {
       throw new betterCall.APIError("UNAUTHORIZED");
     }
     return {
@@ -1058,7 +1058,7 @@ const admin = (options) => {
               message: "invalid permission check. you can only check one resource permission at a time."
             });
           }
-          const session = ctx.context.session;
+          const session = await account.getSessionFromCtx(ctx);
           if (!session && (ctx.request || ctx.headers) && !ctx.body.userId && !ctx.body.role) {
             throw new betterCall.APIError("UNAUTHORIZED");
           }

package/dist/shared/{better-auth.YSKz0i4l.mjs → better-auth.CSVqSIae.mjs}

@@ -1,5 +1,5 @@
 import { createFetch } from '@better-fetch/fetch';
-import { a as getBaseURL } from './better-auth.NcLhHEks.mjs';
+import { a as getBaseURL } from './better-auth.VTXNLFMT.mjs';
 import { atom } from 'nanostores';
 import { u as useAuthQuery } from './better-auth.CQvoVIBD.mjs';
 import { p as parseJSON } from './better-auth.ffWeg50w.mjs';

package/dist/shared/{better-auth.Cx-TsLBb.d.mts → better-auth.CVOWGLfd.d.mts}

@@ -1,6 +1,6 @@
 import * as zod from 'zod';
 import * as better_call from 'better-call';
-import { G as GenericEndpointContext, I as InferOptionSchema, H as HookEndpointContext, l as AuthContext } from './better-auth.imLEY-xr.mjs';
+import { G as GenericEndpointContext, I as InferOptionSchema, H as HookEndpointContext, l as AuthContext } from './better-auth.Ck0xlDsK.mjs';
 import { Statements } from '../plugins/access/index.mjs';
 
 declare const apiKeySchema: ({ timeWindow, rateLimitMax, }: {

package/dist/shared/{better-auth.CoMXyQ1y.mjs → better-auth.CbXAPXob.mjs}

@@ -80,6 +80,7 @@ async function parseState(c) {
     parsedData.errorURL = `${c.context.baseURL}/error`;
   }
   if (parsedData.expiresAt < Date.now()) {
+    await c.context.internalAdapter.deleteVerificationValue(data.id);
     throw c.redirect(
       `${c.context.baseURL}/error?error=please_restart_the_process`
     );

package/dist/shared/{better-auth.imLEY-xr.d.mts → better-auth.Ck0xlDsK.d.mts}

@@ -85,7 +85,7 @@ declare const createInternalAdapter: (adapter: Adapter, ctx: {
     updateSession: (sessionToken: string, session: Partial<Session> & Record<string, any>, context?: GenericEndpointContext) => Promise<any>;
     deleteSession: (token: string) => Promise<void>;
     deleteAccounts: (userId: string) => Promise<void>;
-    deleteAccount: (providerId: string, userId: string) => Promise<void>;
+    deleteAccount: (accountId: string) => Promise<void>;
     deleteSessions: (userIdOrSessionTokens: string | string[]) => Promise<void>;
     findOAuthUser: (email: string, accountId: string, providerId: string) => Promise<{
         user: {
@@ -666,6 +666,7 @@ type EligibleCookies = (string & {}) | (keyof BetterAuthCookies & {});
 declare const getSessionCookie: (request: Request | Headers, config?: {
     cookiePrefix?: string;
     cookieName?: string;
+    useSecureCookies?: boolean;
 }) => string | null;
 declare const getCookieCache: <Session extends {
     session: Session & Record<string, any>;
@@ -2588,7 +2589,7 @@ type BetterAuthOptions = {
     /**
      * List of trusted origins.
      */
-    trustedOrigins?: string[] | ((request: Request) => string[]);
+    trustedOrigins?: string[] | ((request: Request) => string[] | Promise<string[]>);
     /**
      * Rate limiting configuration
      */

package/dist/shared/{better-auth.BS4hQYkx.d.cts → better-auth.Ckf_tP8g.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenericEndpointContext } from './better-auth.BAR_8WbD.cjs';
+import { G as GenericEndpointContext } from './better-auth.Ck0xlDsK.mjs';
 
 declare function generateState(c: GenericEndpointContext, link?: {
     email: string;

package/dist/shared/{better-auth.CqfKuHli.mjs → better-auth.CmplT_y7.mjs}

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { c as createAuthMiddleware, s as sessionMiddleware, a as createAuthEndpoint, g as getSessionFromCtx, B as BASE_ERROR_CODES, M as requestOnlySessionMiddleware } from './better-auth.npe3WWSD.mjs';
+import { c as createAuthMiddleware, s as sessionMiddleware, a as createAuthEndpoint, g as getSessionFromCtx, B as BASE_ERROR_CODES, M as requestOnlySessionMiddleware } from './better-auth.CFZLHBFT.mjs';
 import './better-auth.8zoxzg-F.mjs';
 import '@better-auth/utils/base64';
 import '@better-auth/utils/hmac';
@@ -321,7 +321,8 @@ const getOrgAdapter = (context, options) => {
       const userIds = members.map((member) => member.userId);
       const users = await adapter.findMany({
         model: "user",
-        where: [{ field: "id", value: userIds, operator: "in" }]
+        where: [{ field: "id", value: userIds, operator: "in" }],
+        limit: options?.membershipLimit || 100
       });
       const userMap = new Map(users.map((user) => [user.id, user]));
       const membersWithUsers = members.map((member) => {
@@ -399,7 +400,8 @@ const getOrgAdapter = (context, options) => {
             field: "teamId",
             value: teamId
           }
-        ]
+        ],
+        limit: options?.membershipLimit || 100
       });
       if (!team) {
         return null;
@@ -1792,11 +1794,8 @@ const updateOrganization = createAuthEndpoint(
     }
     const organizationId = ctx.body.organizationId || session.session.activeOrganizationId;
     if (!organizationId) {
-      return ctx.json(null, {
-        status: 400,
-        body: {
-          message: ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND
-        }
+      throw new APIError("BAD_REQUEST", {
+        message: ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND
       });
     }
     const adapter = getOrgAdapter(ctx.context, ctx.context.orgOptions);
@@ -1805,11 +1804,8 @@ const updateOrganization = createAuthEndpoint(
       organizationId
     });
     if (!member) {
-      return ctx.json(null, {
-        status: 400,
-        body: {
-          message: ORGANIZATION_ERROR_CODES.USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION
-        }
+      throw new APIError("BAD_REQUEST", {
+        message: ORGANIZATION_ERROR_CODES.USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION
       });
     }
     const canUpdateOrg = hasPermission({
@@ -1820,11 +1816,8 @@ const updateOrganization = createAuthEndpoint(
       options: ctx.context.orgOptions
     });
     if (!canUpdateOrg) {
-      return ctx.json(null, {
-        body: {
-          message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_ORGANIZATION
-        },
-        status: 403
+      throw new APIError("FORBIDDEN", {
+        message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_ORGANIZATION
       });
     }
     const updatedOrg = await adapter.updateOrganization(

package/dist/shared/{better-auth.BvJDkY_b.cjs → better-auth.Cr6NZZDX.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
 const zod = require('zod');
-const account = require('./better-auth.BzKRBwSF.cjs');
+const account = require('./better-auth.GVCiTzec.cjs');
 require('./better-auth.DiSjtgs9.cjs');
 require('@better-auth/utils/base64');
 require('@better-auth/utils/hmac');
@@ -323,7 +323,8 @@ const getOrgAdapter = (context, options) => {
       const userIds = members.map((member) => member.userId);
       const users = await adapter.findMany({
         model: "user",
-        where: [{ field: "id", value: userIds, operator: "in" }]
+        where: [{ field: "id", value: userIds, operator: "in" }],
+        limit: options?.membershipLimit || 100
       });
       const userMap = new Map(users.map((user) => [user.id, user]));
       const membersWithUsers = members.map((member) => {
@@ -401,7 +402,8 @@ const getOrgAdapter = (context, options) => {
             field: "teamId",
             value: teamId
           }
-        ]
+        ],
+        limit: options?.membershipLimit || 100
       });
       if (!team) {
         return null;
@@ -1794,11 +1796,8 @@ const updateOrganization = account.createAuthEndpoint(
     }
     const organizationId = ctx.body.organizationId || session.session.activeOrganizationId;
     if (!organizationId) {
-      return ctx.json(null, {
-        status: 400,
-        body: {
-          message: ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND
-        }
+      throw new betterCall.APIError("BAD_REQUEST", {
+        message: ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND
       });
     }
     const adapter = getOrgAdapter(ctx.context, ctx.context.orgOptions);
@@ -1807,11 +1806,8 @@ const updateOrganization = account.createAuthEndpoint(
       organizationId
     });
     if (!member) {
-      return ctx.json(null, {
-        status: 400,
-        body: {
-          message: ORGANIZATION_ERROR_CODES.USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION
-        }
+      throw new betterCall.APIError("BAD_REQUEST", {
+        message: ORGANIZATION_ERROR_CODES.USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION
       });
     }
     const canUpdateOrg = hasPermission({
@@ -1822,11 +1818,8 @@ const updateOrganization = account.createAuthEndpoint(
       options: ctx.context.orgOptions
     });
     if (!canUpdateOrg) {
-      return ctx.json(null, {
-        body: {
-          message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_ORGANIZATION
-        },
-        status: 403
+      throw new betterCall.APIError("FORBIDDEN", {
+        message: ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_THIS_ORGANIZATION
       });
     }
     const updatedOrg = await adapter.updateOrganization(

package/dist/shared/{better-auth.BLtLzuLI.d.cts → better-auth.DIRcdXVm.d.cts}

@@ -2,7 +2,7 @@ import { AccessControl, Role, Statements } from '../plugins/access/index.cjs';
 import { z } from 'zod';
 import * as better_call from 'better-call';
 import { b as Prettify } from './better-auth.Bi8FQwDD.cjs';
-import { U as User, S as Session, G as GenericEndpointContext } from './better-auth.BAR_8WbD.cjs';
+import { U as User, S as Session, G as GenericEndpointContext } from './better-auth.CPKTEzG-.cjs';
 import { defaultRoles } from '../plugins/organization/access/index.cjs';
 
 declare const organizationSchema: z.ZodObject<{

package/dist/shared/{better-auth.DayxQ0AW.d.ts → better-auth.DaeQzncE.d.ts}

@@ -1,6 +1,6 @@
 import * as zod from 'zod';
 import * as better_call from 'better-call';
-import { G as GenericEndpointContext, I as InferOptionSchema, H as HookEndpointContext, l as AuthContext } from './better-auth.purQujiV.js';
+import { G as GenericEndpointContext, I as InferOptionSchema, H as HookEndpointContext, l as AuthContext } from './better-auth.DiHCWsNg.js';
 import { Statements } from '../plugins/access/index.js';
 
 declare const apiKeySchema: ({ timeWindow, rateLimitMax, }: {

package/dist/shared/{better-auth.CKg1f8vU.cjs → better-auth.DcpLarbN.cjs}

@@ -480,17 +480,13 @@ const createInternalAdapter = (adapter, ctx) => {
         ]
       });
     },
-    deleteAccount: async (providerId, userId) => {
+    deleteAccount: async (accountId) => {
       await adapter.delete({
         model: "account",
         where: [
           {
-            field: "providerId",
-            value: providerId
-          },
-          {
-            field: "userId",
-            value: userId
+            field: "id",
+            value: accountId
           }
         ]
       });

package/dist/shared/{better-auth.purQujiV.d.ts → better-auth.DiHCWsNg.d.ts}

@@ -85,7 +85,7 @@ declare const createInternalAdapter: (adapter: Adapter, ctx: {
     updateSession: (sessionToken: string, session: Partial<Session> & Record<string, any>, context?: GenericEndpointContext) => Promise<any>;
     deleteSession: (token: string) => Promise<void>;
     deleteAccounts: (userId: string) => Promise<void>;
-    deleteAccount: (providerId: string, userId: string) => Promise<void>;
+    deleteAccount: (accountId: string) => Promise<void>;
     deleteSessions: (userIdOrSessionTokens: string | string[]) => Promise<void>;
     findOAuthUser: (email: string, accountId: string, providerId: string) => Promise<{
         user: {
@@ -666,6 +666,7 @@ type EligibleCookies = (string & {}) | (keyof BetterAuthCookies & {});
 declare const getSessionCookie: (request: Request | Headers, config?: {
     cookiePrefix?: string;
     cookieName?: string;
+    useSecureCookies?: boolean;
 }) => string | null;
 declare const getCookieCache: <Session extends {
     session: Session & Record<string, any>;
@@ -2588,7 +2589,7 @@ type BetterAuthOptions = {
     /**
      * List of trusted origins.
      */
-    trustedOrigins?: string[] | ((request: Request) => string[]);
+    trustedOrigins?: string[] | ((request: Request) => string[] | Promise<string[]>);
     /**
      * Rate limiting configuration
      */

package/dist/shared/{better-auth.CwDUoRLB.cjs → better-auth.Dxrp37xO.cjs}

@@ -2,12 +2,12 @@
 
 const betterCall = require('better-call');
 const zod = require('zod');
-const account = require('./better-auth.BzKRBwSF.cjs');
+const account = require('./better-auth.GVCiTzec.cjs');
 require('./better-auth.DiSjtgs9.cjs');
 require('@better-auth/utils/base64');
 require('@better-auth/utils/hmac');
 require('./better-auth.CHyZMcYK.cjs');
-const crudTeam = require('./better-auth.BvJDkY_b.cjs');
+const crudTeam = require('./better-auth.Cr6NZZDX.cjs');
 const plugins_organization_access_index = require('../plugins/organization/access/index.cjs');
 
 const shimContext = (originalObject, newContext) => {
@@ -166,11 +166,6 @@ const organization = (options) => {
           }
         },
         async (ctx) => {
-          if (!ctx.body.permission || Object.keys(ctx.body.permission).length > 1) {
-            throw new betterCall.APIError("BAD_REQUEST", {
-              message: "invalid permission check. you can only check one resource permission at a time."
-            });
-          }
           const activeOrganizationId = ctx.body.organizationId || ctx.context.session.session.activeOrganizationId;
           if (!activeOrganizationId) {
             throw new betterCall.APIError("BAD_REQUEST", {

package/dist/shared/{better-auth.BzKRBwSF.cjs → better-auth.GVCiTzec.cjs}

@@ -5,7 +5,7 @@ const cookies_index = require('../cookies/index.cjs');
 const betterCall = require('better-call');
 const socialProviders_index = require('../social-providers/index.cjs');
 require('@better-auth/utils/random');
-const state = require('./better-auth.GgQnT00n.cjs');
+const state = require('./better-auth.CHHC_PJT.cjs');
 const logger = require('./better-auth.GpOOav9x.cjs');
 const date = require('./better-auth.C1hdVENX.cjs');
 const id = require('./better-auth.Bg6iw3ig.cjs');
@@ -26,7 +26,7 @@ const hmac = require('@better-auth/utils/hmac');
 require('@better-fetch/fetch');
 require('defu');
 const jwt = require('./better-auth.BMYo0QR-.cjs');
-const url = require('./better-auth.DhfiEsxl.cjs');
+const url = require('./better-auth.C-R0J0n1.cjs');
 const errors = require('jose/errors');
 const json = require('./better-auth.D3mtHEZg.cjs');
 const binary = require('@better-auth/utils/binary');
@@ -178,7 +178,7 @@ const originCheckMiddleware = createAuthMiddleware(async (ctx) => {
   const newUserCallbackURL = body?.newUserCallbackURL;
   const trustedOrigins = Array.isArray(context.options.trustedOrigins) ? context.trustedOrigins : [
     ...context.trustedOrigins,
-    ...context.options.trustedOrigins?.(ctx.request) || []
+    ...await context.options.trustedOrigins?.(ctx.request) || []
   ];
   const usesCookies = ctx.headers?.has("cookie");
   const matchesPattern = (url$1, pattern) => {
@@ -226,7 +226,7 @@ const originCheck = (getValue) => createAuthMiddleware(async (ctx) => {
     context.options.trustedOrigins
   ) ? context.trustedOrigins : [
     ...context.trustedOrigins,
-    ...context.options.trustedOrigins?.(ctx.request) || []
+    ...await context.options.trustedOrigins?.(ctx.request) || []
   ];
   const matchesPattern = (url$1, pattern) => {
     if (url$1.startsWith("/")) {
@@ -1634,9 +1634,7 @@ const callbackOAuth = createAuthEndpoint(
       }
     } catch (e) {
       c.context.logger.error("INVALID_CALLBACK_REQUEST", e);
-      throw c.redirect(
-        `${c.context.baseURL}/error?error=invalid_callback_request`
-      );
+      throw c.redirect(`${defaultErrorURL}?error=invalid_callback_request`);
     }
     const { code, error, state: state$1, error_description, device_id } = queryOrBody;
     if (error) {
@@ -1657,7 +1655,7 @@ const callbackOAuth = createAuthEndpoint(
       requestSignUp
     } = await state.parseState(c);
     function redirectOnError(error2) {
-      let url = errorURL || callbackURL || `${c.context.baseURL}/error`;
+      let url = errorURL || callbackURL || defaultErrorURL;
       if (url.includes("?")) {
         url = `${url}&error=${error2}`;
       } else {
@@ -2577,15 +2575,14 @@ const changeEmail = createAuthEndpoint(
         message: "Change email is disabled"
       });
     }
-    if (ctx.body.newEmail === ctx.context.session.user.email) {
+    const newEmail = ctx.body.newEmail.toLowerCase();
+    if (newEmail === ctx.context.session.user.email) {
       ctx.context.logger.error("Email is the same");
       throw new betterCall.APIError("BAD_REQUEST", {
         message: "Email is the same"
       });
     }
-    const existingUser = await ctx.context.internalAdapter.findUserByEmail(
-      ctx.body.newEmail
-    );
+    const existingUser = await ctx.context.internalAdapter.findUserByEmail(newEmail);
     if (existingUser) {
       ctx.context.logger.error("Email already exists");
       throw new betterCall.APIError("BAD_REQUEST", {
@@ -2593,9 +2590,7 @@ const changeEmail = createAuthEndpoint(
       });
     }
     if (ctx.context.session.user.emailVerified !== true) {
-      const existing = await ctx.context.internalAdapter.findUserByEmail(
-        ctx.body.newEmail
-      );
+      const existing = await ctx.context.internalAdapter.findUserByEmail(newEmail);
       if (existing) {
         throw new betterCall.APIError("UNPROCESSABLE_ENTITY", {
           message: BASE_ERROR_CODES.USER_ALREADY_EXISTS
@@ -2604,15 +2599,22 @@ const changeEmail = createAuthEndpoint(
       await ctx.context.internalAdapter.updateUserByEmail(
         ctx.context.session.user.email,
         {
-          email: ctx.body.newEmail
+          email: newEmail
         },
         ctx
       );
+      await cookies_index.setSessionCookie(ctx, {
+        session: ctx.context.session.session,
+        user: {
+          ...ctx.context.session.user,
+          email: newEmail
+        }
+      });
       if (ctx.context.options.emailVerification?.sendVerificationEmail) {
         const token2 = await createEmailVerificationToken(
           ctx.context.secret,
           ctx.context.session.user.email,
-          ctx.body.newEmail,
+          newEmail,
           ctx.context.options.emailVerification?.expiresIn
         );
         const url2 = `${ctx.context.baseURL}/verify-email?token=${token2}&callbackURL=${ctx.body.callbackURL || "/"}`;
@@ -2620,7 +2622,7 @@ const changeEmail = createAuthEndpoint(
           {
             user: {
               ...ctx.context.session.user,
-              email: ctx.body.newEmail
+              email: newEmail
             },
             url: url2,
             token: token2
@@ -2641,14 +2643,14 @@ const changeEmail = createAuthEndpoint(
     const token = await createEmailVerificationToken(
       ctx.context.secret,
       ctx.context.session.user.email,
-      ctx.body.newEmail,
+      newEmail,
       ctx.context.options.emailVerification?.expiresIn
     );
     const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${ctx.body.callbackURL || "/"}`;
     await ctx.context.options.user.changeEmail.sendChangeEmailVerification(
       {
         user: ctx.context.session.user,
-        newEmail: ctx.body.newEmail,
+        newEmail,
         url,
         token
       },
@@ -2982,10 +2984,7 @@ const unlinkAccount = createAuthEndpoint(
         message: BASE_ERROR_CODES.ACCOUNT_NOT_FOUND
       });
     }
-    await ctx.context.internalAdapter.deleteAccount(
-      ctx.body.providerId,
-      ctx.context.session.user.id
-    );
+    await ctx.context.internalAdapter.deleteAccount(accountExist.id);
     return ctx.json({
       status: true
     });

package/dist/shared/{better-auth.NcLhHEks.mjs → better-auth.VTXNLFMT.mjs}

@@ -19,7 +19,7 @@ function withPath(url, path = "/api/auth") {
   path = path.startsWith("/") ? path : `/${path}`;
   return `${url.replace(/\/+$/, "")}${path}`;
 }
-function getBaseURL(url, path) {
+function getBaseURL(url, path, request) {
   if (url) {
     return withPath(url, path);
   }
@@ -27,6 +27,20 @@ function getBaseURL(url, path) {
   if (fromEnv) {
     return withPath(fromEnv, path);
   }
+  const fromRequest = request?.headers.get("x-forwarded-host");
+  const fromRequestProto = request?.headers.get("x-forwarded-proto");
+  if (fromRequest && fromRequestProto) {
+    return withPath(`${fromRequestProto}://${fromRequest}`, path);
+  }
+  if (request) {
+    const url2 = getOrigin(request.url);
+    if (!url2) {
+      throw new BetterAuthError(
+        "Could not get origin from request. Please provide a valid base URL."
+      );
+    }
+    return withPath(url2, path);
+  }
   if (typeof window !== "undefined" && window.location) {
     return withPath(window.location.origin, path);
   }

package/dist/shared/{better-auth.BxdddeEs.d.mts → better-auth.Vci2tT86.d.cts}

@@ -1,4 +1,4 @@
-import { G as GenericEndpointContext } from './better-auth.imLEY-xr.mjs';
+import { G as GenericEndpointContext } from './better-auth.CPKTEzG-.cjs';
 
 declare function generateState(c: GenericEndpointContext, link?: {
     email: string;

package/dist/shared/{better-auth.977UjO4P.d.ts → better-auth.jVBEmAqh.d.ts}

@@ -2,7 +2,7 @@ import { AccessControl, Role, Statements } from '../plugins/access/index.js';
 import { z } from 'zod';
 import * as better_call from 'better-call';
 import { b as Prettify } from './better-auth.Bi8FQwDD.js';
-import { U as User, S as Session, G as GenericEndpointContext } from './better-auth.purQujiV.js';
+import { U as User, S as Session, G as GenericEndpointContext } from './better-auth.DiHCWsNg.js';
 import { defaultRoles } from '../plugins/organization/access/index.js';
 
 declare const organizationSchema: z.ZodObject<{

package/dist/social-providers/index.cjs

@@ -1070,6 +1070,7 @@ const roblox = (options) => {
       if (error) {
         return null;
       }
+      const userMap = await options.mapProfileToUser?.(profile);
       return {
         user: {
           id: profile.sub,
@@ -1077,7 +1078,8 @@ const roblox = (options) => {
           image: profile.picture,
           email: profile.preferred_username || null,
           // Roblox does not provide email
-          emailVerified: true
+          emailVerified: true,
+          ...userMap
         },
         data: {
           ...profile

package/dist/social-providers/index.mjs

@@ -1068,6 +1068,7 @@ const roblox = (options) => {
       if (error) {
         return null;
       }
+      const userMap = await options.mapProfileToUser?.(profile);
       return {
         user: {
           id: profile.sub,
@@ -1075,7 +1076,8 @@ const roblox = (options) => {
           image: profile.picture,
           email: profile.preferred_username || null,
           // Roblox does not provide email
-          emailVerified: true
+          emailVerified: true,
+          ...userMap
         },
         data: {
           ...profile

package/dist/types/index.d.cts

@@ -1,5 +1,5 @@
-import { B as BetterAuthPlugin, a3 as InferFieldsInputClient, a1 as InferFieldsOutput, U as User, S as Session, i as Auth } from '../shared/better-auth.BAR_8WbD.cjs';
-export { u as Account, g as Adapter, x as AdapterInstance, w as AdapterSchemaCreation, r as AdditionalSessionFieldsInput, s as AdditionalSessionFieldsOutput, p as AdditionalUserFieldsInput, q as AdditionalUserFieldsOutput, l as AuthContext, A as AuthPluginSchema, f as BetterAuthOptions, z as FilterActions, F as FilteredAPI, G as GenericEndpointContext, H as HookEndpointContext, D as InferAPI, I as InferOptionSchema, a as InferPluginErrorCodes, t as InferPluginTypes, k as InferSession, C as InferSessionAPI, j as InferUser, M as Models, R as RateLimit, y as SecondaryStorage, V as Verification, W as Where, v as init } from '../shared/better-auth.BAR_8WbD.cjs';
+import { B as BetterAuthPlugin, a3 as InferFieldsInputClient, a1 as InferFieldsOutput, U as User, S as Session, i as Auth } from '../shared/better-auth.CPKTEzG-.cjs';
+export { u as Account, g as Adapter, x as AdapterInstance, w as AdapterSchemaCreation, r as AdditionalSessionFieldsInput, s as AdditionalSessionFieldsOutput, p as AdditionalUserFieldsInput, q as AdditionalUserFieldsOutput, l as AuthContext, A as AuthPluginSchema, f as BetterAuthOptions, z as FilterActions, F as FilteredAPI, G as GenericEndpointContext, H as HookEndpointContext, D as InferAPI, I as InferOptionSchema, a as InferPluginErrorCodes, t as InferPluginTypes, k as InferSession, C as InferSessionAPI, j as InferUser, M as Models, R as RateLimit, y as SecondaryStorage, V as Verification, W as Where, v as init } from '../shared/better-auth.CPKTEzG-.cjs';
 import { BetterFetchOption, BetterFetchResponse, BetterFetch, BetterFetchPlugin } from '@better-fetch/fetch';
 import { WritableAtom, Atom } from 'nanostores';
 import { U as UnionToIntersection, H as HasRequiredKeys, b as Prettify, L as LiteralString, S as StripEmptyObjects } from '../shared/better-auth.Bi8FQwDD.cjs';
@@ -30,7 +30,7 @@ type InferUserUpdateCtx<ClientOpts extends ClientOptions, FetchOptions extends B
     fetchOptions?: FetchOptions;
 } & Partial<UnionToIntersection<InferAdditionalFromClient<ClientOpts, "user", "input">>>;
 type InferCtx<C extends InputContext<any, any>, FetchOptions extends BetterFetchOption> = C["body"] extends Record<string, any> ? C["body"] & {
-    fetchOptions?: BetterFetchOption<undefined, C["query"], C["params"]>;
+    fetchOptions?: FetchOptions;
 } : C["query"] extends Record<string, any> ? {
     query: C["query"];
     fetchOptions?: FetchOptions;
@@ -59,6 +59,7 @@ type InferRoute<API, COpts extends ClientOptions> = API extends Record<string, i
 } : NonNullable<Awaited<R>>, {
     code?: string;
     message?: string;
+    t?: FetchOptions["throw"];
 }, FetchOptions["throw"] extends true ? true : COpts["fetchOptions"] extends {
     throw: true;
 } ? true : false>> : never : never> : {} : never;