better-auth 1.2.6-beta.7 → 1.2.7-beta.1

package/dist/plugins/email-otp/index.d.mts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 import * as better_call from 'better-call';
-import { H as HookEndpointContext } from '../../shared/better-auth.D-oLmHIj.mjs';
-import '../../shared/better-auth.Bi8FQwDD.mjs';
-import '../../shared/better-auth.bKwabe3I.mjs';
+import { H as HookEndpointContext } from '../../shared/better-auth.DQ7OSJbI.mjs';
+import '../../shared/better-auth.CYegVoq1.mjs';
+import '../../shared/better-auth.B88xucNq.mjs';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';
@@ -48,6 +48,11 @@ interface EmailOTPOptions {
      * @Default false
      */
     disableSignUp?: boolean;
+    /**
+     * Allowed attempts for the OTP code
+     * @default 3
+     */
+    allowedAttempts?: number;
 }
 declare const emailOTP: (options: EmailOTPOptions) => {
     id: "email-otp";
@@ -239,7 +244,7 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                     openapi: {
                         description: string;
                         responses: {
-                            200: {
+                            "200": {
                                 description: string;
                                 content: {
                                     "application/json": {
@@ -248,8 +253,11 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                                             properties: {
                                                 otp: {
                                                     type: string;
+                                                    nullable: boolean;
+                                                    description: string;
                                                 };
                                             };
+                                            required: string[];
                                         };
                                     };
                                 };
@@ -361,9 +369,20 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                                         schema: {
                                             type: "object";
                                             properties: {
+                                                status: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                                token: {
+                                                    type: string;
+                                                    nullable: boolean;
+                                                    description: string;
+                                                };
                                                 user: {
                                                     $ref: string;
                                                 };
+                                                required: string[];
                                             };
                                         };
                                     };
@@ -450,13 +469,15 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                                         schema: {
                                             type: "object";
                                             properties: {
-                                                user: {
-                                                    $ref: string;
+                                                token: {
+                                                    type: string;
+                                                    description: string;
                                                 };
-                                                session: {
+                                                user: {
                                                     $ref: string;
                                                 };
                                             };
+                                            required: string[];
                                         };
                                     };
                                 };
@@ -522,6 +543,7 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                                             properties: {
                                                 success: {
                                                     type: string;
+                                                    description: string;
                                                 };
                                             };
                                         };
@@ -620,9 +642,10 @@ declare const emailOTP: (options: EmailOTPOptions) => {
     };
     $ERROR_CODES: {
         readonly OTP_EXPIRED: "otp expired";
-        readonly INVALID_OTP: "invalid otp";
-        readonly INVALID_EMAIL: "invalid email";
-        readonly USER_NOT_FOUND: "user not found";
+        readonly INVALID_OTP: "Invalid OTP";
+        readonly INVALID_EMAIL: "Invalid email";
+        readonly USER_NOT_FOUND: "User not found";
+        readonly TOO_MANY_ATTEMPTS: "Too many attempts";
     };
     rateLimit: ({
         pathMatcher(path: string): path is "/email-otp/send-verification-otp";

package/dist/plugins/email-otp/index.d.ts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 import * as better_call from 'better-call';
-import { H as HookEndpointContext } from '../../shared/better-auth.DU2QNVc_.js';
-import '../../shared/better-auth.Bi8FQwDD.js';
-import '../../shared/better-auth.BANAxdkL.js';
+import { H as HookEndpointContext } from '../../shared/better-auth.CA2hFK4N.js';
+import '../../shared/better-auth.CYegVoq1.js';
+import '../../shared/better-auth.DNTAFSt1.js';
 import 'jose';
 import 'kysely';
 import 'better-sqlite3';
@@ -48,6 +48,11 @@ interface EmailOTPOptions {
      * @Default false
      */
     disableSignUp?: boolean;
+    /**
+     * Allowed attempts for the OTP code
+     * @default 3
+     */
+    allowedAttempts?: number;
 }
 declare const emailOTP: (options: EmailOTPOptions) => {
     id: "email-otp";
@@ -239,7 +244,7 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                     openapi: {
                         description: string;
                         responses: {
-                            200: {
+                            "200": {
                                 description: string;
                                 content: {
                                     "application/json": {
@@ -248,8 +253,11 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                                             properties: {
                                                 otp: {
                                                     type: string;
+                                                    nullable: boolean;
+                                                    description: string;
                                                 };
                                             };
+                                            required: string[];
                                         };
                                     };
                                 };
@@ -361,9 +369,20 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                                         schema: {
                                             type: "object";
                                             properties: {
+                                                status: {
+                                                    type: string;
+                                                    description: string;
+                                                    enum: boolean[];
+                                                };
+                                                token: {
+                                                    type: string;
+                                                    nullable: boolean;
+                                                    description: string;
+                                                };
                                                 user: {
                                                     $ref: string;
                                                 };
+                                                required: string[];
                                             };
                                         };
                                     };
@@ -450,13 +469,15 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                                         schema: {
                                             type: "object";
                                             properties: {
-                                                user: {
-                                                    $ref: string;
+                                                token: {
+                                                    type: string;
+                                                    description: string;
                                                 };
-                                                session: {
+                                                user: {
                                                     $ref: string;
                                                 };
                                             };
+                                            required: string[];
                                         };
                                     };
                                 };
@@ -522,6 +543,7 @@ declare const emailOTP: (options: EmailOTPOptions) => {
                                             properties: {
                                                 success: {
                                                     type: string;
+                                                    description: string;
                                                 };
                                             };
                                         };
@@ -620,9 +642,10 @@ declare const emailOTP: (options: EmailOTPOptions) => {
     };
     $ERROR_CODES: {
         readonly OTP_EXPIRED: "otp expired";
-        readonly INVALID_OTP: "invalid otp";
-        readonly INVALID_EMAIL: "invalid email";
-        readonly USER_NOT_FOUND: "user not found";
+        readonly INVALID_OTP: "Invalid OTP";
+        readonly INVALID_EMAIL: "Invalid email";
+        readonly USER_NOT_FOUND: "User not found";
+        readonly TOO_MANY_ATTEMPTS: "Too many attempts";
     };
     rateLimit: ({
         pathMatcher(path: string): path is "/email-otp/send-verification-otp";

package/dist/plugins/email-otp/index.mjs

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { APIError } from 'better-call';
-import { c as createAuthMiddleware, a as createAuthEndpoint } from '../../shared/better-auth.D4jH-sJA.mjs';
+import { c as createAuthMiddleware, a as createAuthEndpoint } from '../../shared/better-auth.CWwVo_61.mjs';
 import { setSessionCookie } from '../../cookies/index.mjs';
-import '../../shared/better-auth.CepcSj5H.mjs';
+import '../../shared/better-auth.Cc72UxUH.mjs';
 import '../../shared/better-auth.8zoxzg-F.mjs';
-import '../../shared/better-auth.DH3YjMQH.mjs';
+import '../../shared/better-auth.Cqykj82J.mjs';
 import 'defu';
 import '@better-auth/utils/hash';
 import '@noble/ciphers/chacha';
@@ -25,12 +25,12 @@ import '../../shared/better-auth.DCVeP5-W.mjs';
 import '../../shared/better-auth.DdzSJf-n.mjs';
 import '@better-auth/utils/random';
 import '../../shared/better-auth.BdyOG_p4.mjs';
+import '../../shared/better-auth.tB5eU6EY.mjs';
 import '../../shared/better-auth.BUPPRXfK.mjs';
 import '@better-auth/utils/hmac';
 import '../../shared/better-auth.DDEbWX-S.mjs';
 import '../../shared/better-auth.VTXNLFMT.mjs';
 import 'jose/errors';
-import '../../shared/better-auth.tB5eU6EY.mjs';
 import '@better-auth/utils/binary';
 
 const types = ["email-verification", "sign-in", "forget-password"];
@@ -42,9 +42,10 @@ const emailOTP = (options) => {
   };
   const ERROR_CODES = {
     OTP_EXPIRED: "otp expired",
-    INVALID_OTP: "invalid otp",
-    INVALID_EMAIL: "invalid email",
-    USER_NOT_FOUND: "user not found"
+    INVALID_OTP: "Invalid OTP",
+    INVALID_EMAIL: "Invalid email",
+    USER_NOT_FOUND: "User not found",
+    TOO_MANY_ATTEMPTS: "Too many attempts"
   };
   return {
     id: "email-otp",
@@ -113,7 +114,7 @@ const emailOTP = (options) => {
             ctx.request
           );
           await ctx.context.internalAdapter.createVerificationValue({
-            value: otp,
+            value: `${otp}:0`,
             identifier: `${ctx.body.type}-otp-${email}`,
             expiresAt: getDate(opts.expiresIn, "sec")
           }).catch(async (error) => {
@@ -121,7 +122,7 @@ const emailOTP = (options) => {
               `${ctx.body.type}-otp-${email}`
             );
             await ctx.context.internalAdapter.createVerificationValue({
-              value: otp,
+              value: `${otp}:0`,
               identifier: `${ctx.body.type}-otp-${email}`,
               expiresAt: getDate(opts.expiresIn, "sec")
             });
@@ -177,7 +178,7 @@ const emailOTP = (options) => {
             ctx.request
           );
           await ctx.context.internalAdapter.createVerificationValue({
-            value: otp,
+            value: `${otp}:0`,
             identifier: `${ctx.body.type}-otp-${email}`,
             expiresAt: getDate(opts.expiresIn, "sec")
           });
@@ -199,17 +200,20 @@ const emailOTP = (options) => {
             openapi: {
               description: "Get verification OTP",
               responses: {
-                200: {
-                  description: "Success",
+                "200": {
+                  description: "OTP retrieved successfully or not found/expired",
                   content: {
                     "application/json": {
                       schema: {
                         type: "object",
                         properties: {
                           otp: {
-                            type: "string"
+                            type: "string",
+                            nullable: true,
+                            description: "The stored OTP, or null if not found or expired"
                           }
-                        }
+                        },
+                        required: ["otp"]
                       }
                     }
                   }
@@ -256,9 +260,20 @@ const emailOTP = (options) => {
                       schema: {
                         type: "object",
                         properties: {
+                          status: {
+                            type: "boolean",
+                            description: "Indicates if the verification was successful",
+                            enum: [true]
+                          },
+                          token: {
+                            type: "string",
+                            nullable: true,
+                            description: "Session token if autoSignInAfterVerification is enabled, otherwise null"
+                          },
                           user: {
                             $ref: "#/components/schemas/User"
-                          }
+                          },
+                          required: ["status", "token", "user"]
                         }
                       }
                     }
@@ -289,8 +304,23 @@ const emailOTP = (options) => {
               message: ERROR_CODES.OTP_EXPIRED
             });
           }
-          const otp = ctx.body.otp;
-          if (verificationValue.value !== otp) {
+          const [otpValue, attempts] = verificationValue.value.split(":");
+          const allowedAttempts = options?.allowedAttempts || 3;
+          if (attempts && parseInt(attempts) >= allowedAttempts) {
+            await ctx.context.internalAdapter.deleteVerificationValue(
+              verificationValue.id
+            );
+            throw new APIError("FORBIDDEN", {
+              message: ERROR_CODES.TOO_MANY_ATTEMPTS
+            });
+          }
+          if (ctx.body.otp !== otpValue) {
+            await ctx.context.internalAdapter.updateVerificationValue(
+              verificationValue.id,
+              {
+                value: `${otpValue}:${parseInt(attempts || "0") + 1}`
+              }
+            );
             throw new APIError("BAD_REQUEST", {
               message: ERROR_CODES.INVALID_OTP
             });
@@ -315,7 +345,7 @@ const emailOTP = (options) => {
           if (ctx.context.options.emailVerification?.autoSignInAfterVerification) {
             const session = await ctx.context.internalAdapter.createSession(
               updatedUser.id,
-              ctx.request
+              ctx.headers
             );
             await setSessionCookie(ctx, {
               session,
@@ -373,13 +403,15 @@ const emailOTP = (options) => {
                       schema: {
                         type: "object",
                         properties: {
+                          token: {
+                            type: "string",
+                            description: "Session token for the authenticated session"
+                          },
                           user: {
                             $ref: "#/components/schemas/User"
-                          },
-                          session: {
-                            $ref: "#/components/schemas/Session"
                           }
-                        }
+                        },
+                        required: ["token", "user"]
                       }
                     }
                   }
@@ -403,8 +435,23 @@ const emailOTP = (options) => {
               message: ERROR_CODES.OTP_EXPIRED
             });
           }
-          const otp = ctx.body.otp;
-          if (verificationValue.value !== otp) {
+          const [otpValue, attempts] = verificationValue.value.split(":");
+          const allowedAttempts = options?.allowedAttempts || 3;
+          if (attempts && parseInt(attempts) >= allowedAttempts) {
+            await ctx.context.internalAdapter.deleteVerificationValue(
+              verificationValue.id
+            );
+            throw new APIError("FORBIDDEN", {
+              message: ERROR_CODES.TOO_MANY_ATTEMPTS
+            });
+          }
+          if (ctx.body.otp !== otpValue) {
+            await ctx.context.internalAdapter.updateVerificationValue(
+              verificationValue.id,
+              {
+                value: `${otpValue}:${parseInt(attempts || "0") + 1}`
+              }
+            );
             throw new APIError("BAD_REQUEST", {
               message: ERROR_CODES.INVALID_OTP
             });
@@ -429,7 +476,7 @@ const emailOTP = (options) => {
             );
             const session2 = await ctx.context.internalAdapter.createSession(
               newUser.id,
-              ctx.request
+              ctx.headers
             );
             await setSessionCookie(ctx, {
               session: session2,
@@ -459,7 +506,7 @@ const emailOTP = (options) => {
           }
           const session = await ctx.context.internalAdapter.createSession(
             user.user.id,
-            ctx.request
+            ctx.headers
           );
           await setSessionCookie(ctx, {
             session,
@@ -500,7 +547,8 @@ const emailOTP = (options) => {
                         type: "object",
                         properties: {
                           success: {
-                            type: "boolean"
+                            type: "boolean",
+                            description: "Indicates if the OTP was sent successfully"
                           }
                         }
                       }
@@ -524,7 +572,7 @@ const emailOTP = (options) => {
             ctx.request
           );
           await ctx.context.internalAdapter.createVerificationValue({
-            value: otp,
+            value: `${otp}:0`,
             identifier: `forget-password-otp-${email}`,
             expiresAt: getDate(opts.expiresIn, "sec")
           });
@@ -601,12 +649,30 @@ const emailOTP = (options) => {
             });
           }
           if (verificationValue.expiresAt < /* @__PURE__ */ new Date()) {
+            await ctx.context.internalAdapter.deleteVerificationValue(
+              verificationValue.id
+            );
             throw new APIError("BAD_REQUEST", {
               message: ERROR_CODES.OTP_EXPIRED
             });
           }
-          const otp = ctx.body.otp;
-          if (verificationValue.value !== otp) {
+          const [otpValue, attempts] = verificationValue.value.split(":");
+          const allowedAttempts = options?.allowedAttempts || 3;
+          if (attempts && parseInt(attempts) >= allowedAttempts) {
+            await ctx.context.internalAdapter.deleteVerificationValue(
+              verificationValue.id
+            );
+            throw new APIError("FORBIDDEN", {
+              message: ERROR_CODES.TOO_MANY_ATTEMPTS
+            });
+          }
+          if (ctx.body.otp !== otpValue) {
+            await ctx.context.internalAdapter.updateVerificationValue(
+              verificationValue.id,
+              {
+                value: `${otpValue}:${parseInt(attempts || "0") + 1}`
+              }
+            );
             throw new APIError("BAD_REQUEST", {
               message: ERROR_CODES.INVALID_OTP
             });
@@ -658,7 +724,7 @@ const emailOTP = (options) => {
                 ctx.request
               );
               await ctx.context.internalAdapter.createVerificationValue({
-                value: otp,
+                value: `${otp}:0`,
                 identifier: `email-verification-otp-${email}`,
                 expiresAt: getDate(opts.expiresIn, "sec")
               });

package/dist/plugins/generic-oauth/index.cjs

@@ -3,9 +3,9 @@
 const fetch = require('@better-fetch/fetch');
 const betterCall = require('better-call');
 const zod = require('zod');
-const refreshToken = require('../../shared/better-auth.BDYXUcLv.cjs');
+const refreshToken = require('../../shared/better-auth.Dg0siV5C.cjs');
 const cookies_index = require('../../cookies/index.cjs');
-require('../../shared/better-auth.C5H9XEzZ.cjs');
+require('../../shared/better-auth.DcWKCjjf.cjs');
 require('../../shared/better-auth.DiSjtgs9.cjs');
 require('../../shared/better-auth.GpOOav9x.cjs');
 require('defu');
@@ -25,13 +25,13 @@ require('@noble/hashes/utils');
 require('../../shared/better-auth.CYeOI8C-.cjs');
 require('@better-auth/utils/random');
 require('../../shared/better-auth.ANpbi45u.cjs');
+require('../../shared/better-auth.D3mtHEZg.cjs');
 require('../../shared/better-auth.C1hdVENX.cjs');
 require('../../shared/better-auth.Bg6iw3ig.cjs');
 require('@better-auth/utils/hmac');
 require('../../shared/better-auth.BMYo0QR-.cjs');
 require('../../shared/better-auth.C-R0J0n1.cjs');
 require('jose/errors');
-require('../../shared/better-auth.D3mtHEZg.cjs');
 require('@better-auth/utils/binary');
 
 async function getUserInfo(tokens, finalUserInfoUrl) {
@@ -97,7 +97,8 @@ const genericOAuth = (options) => {
             let finalTokenUrl = c.tokenUrl;
             if (c.discoveryUrl) {
               const discovery = await fetch.betterFetch(c.discoveryUrl, {
-                method: "GET"
+                method: "GET",
+                headers: c.discoveryHeaders
               });
               if (discovery.data) {
                 finalTokenUrl = discovery.data.token_endpoint;
@@ -125,7 +126,8 @@ const genericOAuth = (options) => {
             let finalTokenUrl = c.tokenUrl;
             if (c.discoveryUrl) {
               const discovery = await fetch.betterFetch(c.discoveryUrl, {
-                method: "GET"
+                method: "GET",
+                headers: c.discoveryHeaders
               });
               if (discovery.data) {
                 finalTokenUrl = discovery.data.token_endpoint;
@@ -142,6 +144,7 @@ const genericOAuth = (options) => {
                 clientId: c.clientId,
                 clientSecret: c.clientSecret
               },
+              authentication: c.authentication,
               tokenEndpoint: finalTokenUrl
             });
           },
@@ -257,6 +260,8 @@ const genericOAuth = (options) => {
           let finalTokenUrl = tokenUrl;
           if (discoveryUrl) {
             const discovery = await fetch.betterFetch(discoveryUrl, {
+              method: "GET",
+              headers: config.discoveryHeaders,
               onError(context) {
                 ctx.context.logger.error(context.error.message, context.error, {
                   discoveryUrl
@@ -381,7 +386,8 @@ const genericOAuth = (options) => {
           let finalUserInfoUrl = provider.userInfoUrl;
           if (provider.discoveryUrl) {
             const discovery = await fetch.betterFetch(provider.discoveryUrl, {
-              method: "GET"
+              method: "GET",
+              headers: provider.discoveryHeaders
             });
             if (discovery.data) {
               finalTokenUrl = discovery.data.token_endpoint;
@@ -431,18 +437,40 @@ const genericOAuth = (options) => {
             if (ctx.context.options.account?.accountLinking?.allowDifferentEmails !== true && link.email !== mapUser.email.toLowerCase()) {
               return redirectOnError("email_doesn't_match");
             }
-            const newAccount = await ctx.context.internalAdapter.createAccount({
-              userId: link.userId,
-              providerId: provider.providerId,
-              accountId: userInfo.id,
-              accessToken: tokens.accessToken,
-              refreshToken: tokens.refreshToken,
-              accessTokenExpiresAt: tokens.accessTokenExpiresAt,
-              refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
-              scope: tokens.scopes?.join(",")
-            });
-            if (!newAccount) {
-              return redirectOnError("unable_to_link_account");
+            const existingAccount = await ctx.context.internalAdapter.findAccount(userInfo.id);
+            if (existingAccount) {
+              if (existingAccount.userId !== link.userId) {
+                return redirectOnError(
+                  "account_already_linked_to_different_user"
+                );
+              }
+              const updateData = Object.fromEntries(
+                Object.entries({
+                  accessToken: tokens.accessToken,
+                  idToken: tokens.idToken,
+                  refreshToken: tokens.refreshToken,
+                  accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+                  refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+                  scope: tokens.scopes?.join(",")
+                }).filter(([_, value]) => value !== void 0)
+              );
+              await ctx.context.internalAdapter.updateAccount(
+                existingAccount.id,
+                updateData
+              );
+            } else {
+              const newAccount = await ctx.context.internalAdapter.createAccount({
+                userId: link.userId,
+                providerId: provider.providerId,
+                accountId: userInfo.id,
+                accessToken: tokens.accessToken,
+                accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+                refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+                scope: tokens.scopes?.join(",")
+              });
+              if (!newAccount) {
+                return redirectOnError("unable_to_link_account");
+              }
             }
             let toRedirectTo2;
             try {
@@ -464,7 +492,8 @@ const genericOAuth = (options) => {
               ...tokens,
               scope: tokens.scopes?.join(",")
             },
-            disableSignUp: provider.disableImplicitSignUp && !requestSignUp || provider.disableSignUp
+            disableSignUp: provider.disableImplicitSignUp && !requestSignUp || provider.disableSignUp,
+            overrideUserInfo: provider.overrideUserInfo
           });
           if (result.error) {
             return redirectOnError(result.error.split(" ").join("_"));
@@ -492,7 +521,37 @@ const genericOAuth = (options) => {
             providerId: zod.z.string(),
             callbackURL: zod.z.string()
           }),
-          use: [refreshToken.sessionMiddleware]
+          use: [refreshToken.sessionMiddleware],
+          metadata: {
+            openapi: {
+              description: "Link an OAuth2 account to the current user session",
+              responses: {
+                "200": {
+                  description: "Authorization URL generated successfully for linking an OAuth2 account",
+                  content: {
+                    "application/json": {
+                      schema: {
+                        type: "object",
+                        properties: {
+                          url: {
+                            type: "string",
+                            format: "uri",
+                            description: "The authorization URL to redirect the user to for linking the OAuth2 account"
+                          },
+                          redirect: {
+                            type: "boolean",
+                            description: "Indicates that the client should redirect to the provided URL",
+                            enum: [true]
+                          }
+                        },
+                        required: ["url", "redirect"]
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
         },
         async (c) => {
           const session = c.context.session;
@@ -536,6 +595,8 @@ const genericOAuth = (options) => {
               });
             }
             const discovery = await fetch.betterFetch(discoveryUrl, {
+              method: "GET",
+              headers: provider.discoveryHeaders,
               onError(context) {
                 c.context.logger.error(context.error.message, context.error, {
                   discoveryUrl