better-auth 1.6.11 → 1.6.13

package/dist/plugins/open-api/generator.mjs

@@ -1,6 +1,7 @@
 import { db_exports } from "../../db/index.mjs";
 import { getEndpoints } from "../../api/index.mjs";
 import * as z from "zod";
+import { toPascalCase } from "@better-auth/core/utils/string";
 //#region src/plugins/open-api/generator.ts
 const allowedType = new Set([
 	"string",
@@ -156,7 +157,7 @@ function getResponse(responses) {
 			} } },
 			description: "Internal Server Error. This is a problem with the server that you cannot fix."
 		},
-		...responses
+		...responses ? structuredClone(responses) : {}
 	};
 }
 function toOpenApiPath(path) {
@@ -196,6 +197,16 @@ async function generator(ctx, options) {
 		return acc;
 	}, {}) } };
 	const paths = {};
+	const seenOperationIds = /* @__PURE__ */ new Set();
+	const uniqueOperationId = (operationId, method) => {
+		if (!operationId) return void 0;
+		const base = seenOperationIds.has(operationId) ? `${operationId}${toPascalCase(method)}` : operationId;
+		let result = base;
+		let n = 2;
+		while (seenOperationIds.has(result)) result = `${base}${n++}`;
+		seenOperationIds.add(result);
+		return result;
+	};
 	Object.entries(baseEndpoints.api).forEach(([_, value]) => {
 		if (!value.path || ctx.options.disabledPaths?.includes(value.path)) return;
 		const options = value.options;
@@ -207,7 +218,7 @@ async function generator(ctx, options) {
 			[method.toLowerCase()]: {
 				tags: ["Default", ...options.metadata?.openapi?.tags || []],
 				description: options.metadata?.openapi?.description,
-				operationId: options.metadata?.openapi?.operationId,
+				operationId: uniqueOperationId(options.metadata?.openapi?.operationId, method),
 				security: [{ bearerAuth: [] }],
 				parameters: getParameters(options),
 				responses: getResponse(options.metadata?.openapi?.responses)
@@ -220,7 +231,7 @@ async function generator(ctx, options) {
 				[method.toLowerCase()]: {
 					tags: ["Default", ...options.metadata?.openapi?.tags || []],
 					description: options.metadata?.openapi?.description,
-					operationId: options.metadata?.openapi?.operationId,
+					operationId: uniqueOperationId(options.metadata?.openapi?.operationId, method),
 					security: [{ bearerAuth: [] }],
 					parameters: getParameters(options),
 					...body ? { requestBody: body } : { requestBody: { content: { "application/json": { schema: {
@@ -253,7 +264,7 @@ async function generator(ctx, options) {
 				[method.toLowerCase()]: {
 					tags: options.metadata?.openapi?.tags || [plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)],
 					description: options.metadata?.openapi?.description,
-					operationId: options.metadata?.openapi?.operationId,
+					operationId: uniqueOperationId(options.metadata?.openapi?.operationId, method),
 					security: [{ bearerAuth: [] }],
 					parameters: getParameters(options),
 					responses: getResponse(options.metadata?.openapi?.responses)
@@ -264,7 +275,7 @@ async function generator(ctx, options) {
 				[method.toLowerCase()]: {
 					tags: options.metadata?.openapi?.tags || [plugin.id.charAt(0).toUpperCase() + plugin.id.slice(1)],
 					description: options.metadata?.openapi?.description,
-					operationId: options.metadata?.openapi?.operationId,
+					operationId: uniqueOperationId(options.metadata?.openapi?.operationId, method),
 					security: [{ bearerAuth: [] }],
 					parameters: getParameters(options),
 					requestBody: getRequestBody(options),

package/dist/plugins/organization/adapter.mjs

@@ -1,6 +1,6 @@
 import { getDate } from "../../utils/date.mjs";
 import { parseJSON } from "../../client/parser.mjs";
-import { getCurrentAdapter } from "@better-auth/core/context";
+import { getCurrentAdapter, runWithTransaction } from "@better-auth/core/context";
 import { BetterAuthError } from "@better-auth/core/error";
 import { filterOutputFields } from "@better-auth/core/utils/db";
 //#region src/plugins/organization/adapter.ts
@@ -184,46 +184,49 @@ const getOrgAdapter = (context, options) => {
 			});
 		},
 		deleteMember: async ({ memberId, organizationId, userId: _userId }) => {
-			const adapter = await getCurrentAdapter(baseAdapter);
-			let userId;
-			if (!_userId) {
-				const member = await adapter.findOne({
+			return runWithTransaction(baseAdapter, async () => {
+				const adapter = await getCurrentAdapter(baseAdapter);
+				let userId;
+				if (!_userId) {
+					const member = await adapter.findOne({
+						model: "member",
+						where: [{
+							field: "id",
+							value: memberId
+						}]
+					});
+					if (!member) throw new BetterAuthError("Member not found");
+					userId = member.userId;
+				} else userId = _userId;
+				const member = await adapter.delete({
 					model: "member",
 					where: [{
 						field: "id",
 						value: memberId
 					}]
 				});
-				if (!member) throw new BetterAuthError("Member not found");
-				userId = member.userId;
-			} else userId = _userId;
-			const member = await adapter.delete({
-				model: "member",
-				where: [{
-					field: "id",
-					value: memberId
-				}]
+				if (options?.teams?.enabled) {
+					const teams = await adapter.findMany({
+						model: "team",
+						where: [{
+							field: "organizationId",
+							value: organizationId
+						}]
+					});
+					if (teams.length > 0) await adapter.deleteMany({
+						model: "teamMember",
+						where: [{
+							field: "userId",
+							value: userId
+						}, {
+							field: "teamId",
+							value: teams.map((team) => team.id),
+							operator: "in"
+						}]
+					});
+				}
+				return member;
 			});
-			if (options?.teams?.enabled) {
-				const teams = await adapter.findMany({
-					model: "team",
-					where: [{
-						field: "organizationId",
-						value: organizationId
-					}]
-				});
-				await Promise.all(teams.map((team) => adapter.deleteMany({
-					model: "teamMember",
-					where: [{
-						field: "teamId",
-						value: team.id
-					}, {
-						field: "userId",
-						value: userId
-					}]
-				})));
-			}
-			return member;
 		},
 		updateOrganization: async (organizationId, data) => {
 			const organization = await (await getCurrentAdapter(baseAdapter)).update({
@@ -244,29 +247,31 @@ const getOrgAdapter = (context, options) => {
 			}, orgAdditionalFields);
 		},
 		deleteOrganization: async (organizationId) => {
-			const adapter = await getCurrentAdapter(baseAdapter);
-			await adapter.deleteMany({
-				model: "member",
-				where: [{
-					field: "organizationId",
-					value: organizationId
-				}]
-			});
-			await adapter.deleteMany({
-				model: "invitation",
-				where: [{
-					field: "organizationId",
-					value: organizationId
-				}]
-			});
-			await adapter.delete({
-				model: "organization",
-				where: [{
-					field: "id",
-					value: organizationId
-				}]
+			return runWithTransaction(baseAdapter, async () => {
+				const adapter = await getCurrentAdapter(baseAdapter);
+				await adapter.deleteMany({
+					model: "member",
+					where: [{
+						field: "organizationId",
+						value: organizationId
+					}]
+				});
+				await adapter.deleteMany({
+					model: "invitation",
+					where: [{
+						field: "organizationId",
+						value: organizationId
+					}]
+				});
+				await adapter.delete({
+					model: "organization",
+					where: [{
+						field: "id",
+						value: organizationId
+					}]
+				});
+				return organizationId;
 			});
-			return organizationId;
 		},
 		setActiveOrganization: async (sessionToken, organizationId, ctx) => {
 			return await context.internalAdapter.updateSession(sessionToken, { activeOrganizationId: organizationId });

package/dist/plugins/organization/client.d.mts

@@ -273,6 +273,7 @@ declare const organizationClient: <CO extends OrganizationClientOptions>(options
     ROLE_NAME_IS_ALREADY_TAKEN: _better_auth_core_utils_error_codes0.RawError<"ROLE_NAME_IS_ALREADY_TAKEN">;
     CANNOT_DELETE_A_PRE_DEFINED_ROLE: _better_auth_core_utils_error_codes0.RawError<"CANNOT_DELETE_A_PRE_DEFINED_ROLE">;
     ROLE_IS_ASSIGNED_TO_MEMBERS: _better_auth_core_utils_error_codes0.RawError<"ROLE_IS_ASSIGNED_TO_MEMBERS">;
+    INVALID_TEAM_ID: _better_auth_core_utils_error_codes0.RawError<"INVALID_TEAM_ID">;
   };
 };
 declare const inferOrgAdditionalFields: <O extends {
@@ -371,4 +372,4 @@ declare const inferOrgAdditionalFields: <O extends {
   additionalFields: unknown;
 } ? K : never]: S_1[K] } : undefined : undefined : undefined : S;
 //#endregion
-export { clientSideHasPermission, inferOrgAdditionalFields, organizationClient };
+export { OrganizationClientOptions, clientSideHasPermission, inferOrgAdditionalFields, organizationClient };

package/dist/plugins/organization/error-codes.d.mts

@@ -60,6 +60,7 @@ declare const ORGANIZATION_ERROR_CODES: {
   ROLE_NAME_IS_ALREADY_TAKEN: _better_auth_core_utils_error_codes0.RawError<"ROLE_NAME_IS_ALREADY_TAKEN">;
   CANNOT_DELETE_A_PRE_DEFINED_ROLE: _better_auth_core_utils_error_codes0.RawError<"CANNOT_DELETE_A_PRE_DEFINED_ROLE">;
   ROLE_IS_ASSIGNED_TO_MEMBERS: _better_auth_core_utils_error_codes0.RawError<"ROLE_IS_ASSIGNED_TO_MEMBERS">;
+  INVALID_TEAM_ID: _better_auth_core_utils_error_codes0.RawError<"INVALID_TEAM_ID">;
 };
 //#endregion
 export { ORGANIZATION_ERROR_CODES };

package/dist/plugins/organization/error-codes.mjs

@@ -58,7 +58,8 @@ const ORGANIZATION_ERROR_CODES = defineErrorCodes({
 	INVALID_RESOURCE: "The provided permission includes an invalid resource",
 	ROLE_NAME_IS_ALREADY_TAKEN: "That role name is already taken",
 	CANNOT_DELETE_A_PRE_DEFINED_ROLE: "Cannot delete a pre-defined role",
-	ROLE_IS_ASSIGNED_TO_MEMBERS: "Cannot delete a role that is assigned to members. Please reassign the members to a different role first"
+	ROLE_IS_ASSIGNED_TO_MEMBERS: "Cannot delete a role that is assigned to members. Please reassign the members to a different role first",
+	INVALID_TEAM_ID: "Team id contains a reserved character"
 });
 //#endregion
 export { ORGANIZATION_ERROR_CODES };

package/dist/plugins/organization/routes/crud-invites.mjs

@@ -155,6 +155,9 @@ const createInvitation = (option) => {
 			member
 		}, ctx.context) : ctx.context.orgOptions.invitationLimit ?? 100;
 		if ((await adapter.findPendingInvitations({ organizationId })).length >= invitationLimit) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.INVITATION_LIMIT_REACHED);
+		if (ctx.context.orgOptions.teams?.enabled && "teamId" in ctx.body && ctx.body.teamId) {
+			if ((typeof ctx.body.teamId === "string" ? [ctx.body.teamId] : ctx.body.teamId).some((id) => id.includes(","))) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.INVALID_TEAM_ID);
+		}
 		if (ctx.context.orgOptions.teams && ctx.context.orgOptions.teams.enabled && typeof ctx.context.orgOptions.teams.maximumMembersPerTeam !== "undefined" && "teamId" in ctx.body && ctx.body.teamId) {
 			const teamIds = typeof ctx.body.teamId === "string" ? [ctx.body.teamId] : ctx.body.teamId;
 			for (const teamId of teamIds) {

package/dist/plugins/organization/routes/crud-org.d.mts

@@ -15,7 +15,7 @@ declare const createOrganization: <O extends OrganizationOptions>(options?: O |
     name: z.ZodString;
     slug: z.ZodString;
     userId: z.ZodOptional<z.ZodCoercedString<unknown>>;
-    logo: z.ZodOptional<z.ZodString>;
+    logo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     keepCurrentActiveOrganization: z.ZodOptional<z.ZodBoolean>;
   }, z.core.$strip>;
@@ -55,7 +55,7 @@ declare const createOrganization: <O extends OrganizationOptions>(options?: O |
         name: string;
         slug: string;
         userId?: string | undefined;
-        logo?: string | undefined;
+        logo?: string | null | undefined;
         metadata?: Record<string, any> | undefined;
         keepCurrentActiveOrganization?: boolean | undefined;
       };
@@ -165,7 +165,7 @@ declare const updateOrganization: <O extends OrganizationOptions>(options?: O |
     data: z.ZodObject<{
       name: z.ZodOptional<z.ZodOptional<z.ZodString>>;
       slug: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-      logo: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+      logo: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
       metadata: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>>;
     }, z.core.$strip>;
     organizationId: z.ZodOptional<z.ZodString>;
@@ -207,7 +207,7 @@ declare const updateOrganization: <O extends OrganizationOptions>(options?: O |
         data: {
           name?: string | undefined;
           slug?: string | undefined;
-          logo?: string | undefined;
+          logo?: string | null | undefined;
           metadata?: Record<string, any> | undefined;
         } & Partial<InferAdditionalFieldsFromPluginOptions<"organization", O>>;
         organizationId?: string | undefined;

package/dist/plugins/organization/routes/crud-org.mjs

@@ -13,7 +13,7 @@ const baseOrganizationSchema = z.object({
 	name: z.string().min(1).meta({ description: "The name of the organization" }),
 	slug: z.string().min(1).meta({ description: "The slug of the organization" }),
 	userId: z.coerce.string().meta({ description: "The user id of the organization creator. If not provided, the current user will be used. Should only be used by admins or when called by the server. server-only. Eg: \"user-id\"" }).optional(),
-	logo: z.string().meta({ description: "The logo of the organization" }).optional(),
+	logo: z.string().meta({ description: "The logo of the organization" }).nullish(),
 	metadata: z.record(z.string(), z.any()).meta({ description: "The metadata of the organization" }).optional(),
 	keepCurrentActiveOrganization: z.boolean().meta({ description: "Whether to keep the current active organization active after creating a new one. Eg: true" }).optional()
 });
@@ -160,7 +160,7 @@ const checkOrganizationSlug = (options) => createAuthEndpoint("/organization/che
 const baseUpdateOrganizationSchema = z.object({
 	name: z.string().min(1).meta({ description: "The name of the organization" }).optional(),
 	slug: z.string().min(1).meta({ description: "The slug of the organization" }).optional(),
-	logo: z.string().meta({ description: "The logo of the organization" }).optional(),
+	logo: z.string().meta({ description: "The logo of the organization" }).nullish(),
 	metadata: z.record(z.string(), z.any()).meta({ description: "The metadata of the organization" }).optional()
 });
 const updateOrganization = (options) => {

package/dist/plugins/organization/types.d.mts

@@ -317,7 +317,7 @@ interface OrganizationOptions {
       organization: {
         name?: string;
         slug?: string;
-        logo?: string;
+        logo?: string | null;
         metadata?: Record<string, any>;
         [key: string]: any;
       };
@@ -348,7 +348,7 @@ interface OrganizationOptions {
       organization: {
         name?: string;
         slug?: string;
-        logo?: string;
+        logo?: string | null;
         metadata?: Record<string, any>;
         [key: string]: any;
       };
@@ -358,7 +358,7 @@ interface OrganizationOptions {
       data: {
         name?: string;
         slug?: string;
-        logo?: string;
+        logo?: string | null;
         metadata?: Record<string, any>;
         [key: string]: any;
       };

package/dist/plugins/phone-number/routes.mjs

@@ -470,7 +470,7 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 	else await ctx.context.internalAdapter.updatePassword(user.id, hashedPassword);
 	await ctx.context.internalAdapter.deleteVerificationByIdentifier(phoneResetIdentifier);
 	if (ctx.context.options.emailAndPassword?.onPasswordReset) await ctx.context.options.emailAndPassword.onPasswordReset({ user }, ctx.request);
-	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteSessions(user.id);
+	if (ctx.context.options.emailAndPassword?.revokeSessionsOnPasswordReset) await ctx.context.internalAdapter.deleteUserSessions(user.id);
 	return ctx.json({ status: true });
 });
 function generateOTP(size) {

package/dist/plugins/two-factor/backup-codes/index.d.mts

@@ -264,9 +264,10 @@ declare const backupCode2fa: (opts: BackupCodeOptions) => {
       backupCodes: string[];
     }>;
     /**
-     * ### Endpoint
-     *
-     * POST `/two-factor/view-backup-codes`
+     * A server-only function that returns a user's decrypted two-factor
+     * backup codes. It is not exposed over HTTP and has no client method;
+     * call it from trusted server code with a `userId` taken from an
+     * authenticated session.
      *
      * ### API Methods
      *

package/dist/plugins/two-factor/client.mjs

@@ -1,5 +1,6 @@
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
+import { isSafeUrlScheme } from "@better-auth/core/utils/url";
 //#region src/plugins/two-factor/client.ts
 const twoFactorClient = (options) => {
 	return {
@@ -29,7 +30,7 @@ const twoFactorClient = (options) => {
 						await options.onTwoFactorRedirect({ twoFactorMethods: context.data.twoFactorMethods });
 						return;
 					}
-					if (options?.twoFactorPage && typeof window !== "undefined") window.location.href = options.twoFactorPage;
+					if (options?.twoFactorPage && typeof window !== "undefined" && isSafeUrlScheme(options.twoFactorPage)) window.location.href = options.twoFactorPage;
 				}
 			} }
 		}],

package/dist/plugins/two-factor/index.mjs

@@ -2,7 +2,7 @@ import { mergeSchema } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { sessionMiddleware } from "../../api/routes/session.mjs";
+import { sensitiveSessionMiddleware, sessionMiddleware } from "../../api/routes/session.mjs";
 import { shouldRequirePassword, validatePassword } from "../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
@@ -138,7 +138,7 @@ const twoFactor = (options) => {
 			disableTwoFactor: createAuthEndpoint("/two-factor/disable", {
 				method: "POST",
 				body: disableTwoFactorBodySchema,
-				use: [sessionMiddleware],
+				use: [sensitiveSessionMiddleware],
 				metadata: { openapi: {
 					summary: "Disable two factor authentication",
 					description: "Use this endpoint to disable two factor authentication.",
@@ -224,6 +224,7 @@ const twoFactor = (options) => {
 				*/
 				deleteSessionCookie(ctx, true);
 				await ctx.context.internalAdapter.deleteSession(data.session.token);
+				ctx.context.setNewSession(null);
 				const maxAge = options?.twoFactorCookieMaxAge ?? 600;
 				const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME, { maxAge });
 				const identifier = `2fa-${generateRandomString(20)}`;

package/dist/plugins/username/index.d.mts

@@ -90,9 +90,20 @@ declare const username: (options?: UsernameOptions | undefined) => {
               name: string;
               image?: string | null | undefined;
             } & Record<string, unknown>, context: _better_auth_core0.GenericEndpointContext | null): Promise<{
+              data: {
+                username: string;
+                displayUsername: string;
+                id: string;
+                createdAt: Date;
+                updatedAt: Date;
+                email: string;
+                emailVerified: boolean;
+                name: string;
+                image?: string | null | undefined;
+              };
+            } | {
               data: {
                 displayUsername?: string | undefined;
-                username?: string | undefined;
                 id: string;
                 createdAt: Date;
                 updatedAt: Date;
@@ -115,7 +126,18 @@ declare const username: (options?: UsernameOptions | undefined) => {
             }> & Record<string, unknown>, context: _better_auth_core0.GenericEndpointContext | null): Promise<{
               data: {
                 displayUsername?: string | undefined;
-                username?: string | undefined;
+                username: string;
+                id?: string | undefined;
+                createdAt?: Date | undefined;
+                updatedAt?: Date | undefined;
+                email?: string | undefined;
+                emailVerified?: boolean | undefined;
+                name?: string | undefined;
+                image?: string | null | undefined;
+              };
+            } | {
+              data: {
+                displayUsername?: string | undefined;
                 id?: string | undefined;
                 createdAt?: Date | undefined;
                 updatedAt?: Date | undefined;

package/dist/plugins/username/index.mjs

@@ -28,6 +28,31 @@ const username = (options) => {
 	const displayUsernameNormalizer = (displayUsername) => {
 		return options?.displayUsernameNormalization ? options.displayUsernameNormalization(displayUsername) : displayUsername;
 	};
+	const minUsernameLength = options?.minUsernameLength || 3;
+	const maxUsernameLength = options?.maxUsernameLength || 30;
+	const validator = options?.usernameValidator || defaultUsernameValidator;
+	const pathsWithHttpHookValidation = ["/sign-up/email", "/update-user"];
+	async function validateUsername(username, displayUsername, adapter, currentUserId) {
+		const usernameToValidate = options?.validationOrder?.username === "post-normalization" ? normalizer(username) : username;
+		if (usernameToValidate.length < minUsernameLength) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_TOO_SHORT);
+		if (usernameToValidate.length > maxUsernameLength) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
+		if (!await validator(usernameToValidate)) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.INVALID_USERNAME);
+		const normalizedUsername = normalizer(username);
+		const existingUser = await adapter.findOne({
+			model: "user",
+			where: [{
+				field: "username",
+				value: normalizedUsername
+			}]
+		});
+		if (existingUser) {
+			if (!currentUserId || existingUser.id !== currentUserId) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_IS_ALREADY_TAKEN);
+		}
+		if (displayUsername && options?.displayUsernameValidator) {
+			const displayUsernameToValidate = options?.validationOrder?.displayUsername === "post-normalization" ? displayUsernameNormalizer(displayUsername) : displayUsername;
+			if (!await options.displayUsernameValidator(displayUsernameToValidate)) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.INVALID_DISPLAY_USERNAME);
+		}
+	}
 	return {
 		id: "username",
 		version: PACKAGE_VERSION,
@@ -36,18 +61,39 @@ const username = (options) => {
 				create: { async before(user, context) {
 					const username = "username" in user ? user.username : null;
 					const displayUsername = "displayUsername" in user ? user.displayUsername : null;
+					const currentPath = context?.path;
+					const skipValidation = currentPath && pathsWithHttpHookValidation.includes(currentPath);
+					if (username) {
+						if (!skipValidation) await validateUsername(username, displayUsername, ctx.adapter);
+						return { data: {
+							...user,
+							username: normalizer(username),
+							displayUsername: displayUsername ? displayUsernameNormalizer(displayUsername) : username
+						} };
+					}
 					return { data: {
 						...user,
-						...username ? { username: normalizer(username) } : {},
 						...displayUsername ? { displayUsername: displayUsernameNormalizer(displayUsername) } : {}
 					} };
 				} },
 				update: { async before(user, context) {
 					const username = "username" in user ? user.username : null;
 					const displayUsername = "displayUsername" in user ? user.displayUsername : null;
+					const currentPath = context?.path;
+					const skipValidation = currentPath && pathsWithHttpHookValidation.includes(currentPath);
+					if (username) {
+						if (!skipValidation) {
+							const currentUserId = context?.context?.session?.user?.id || ("id" in user ? user.id : null);
+							await validateUsername(username, displayUsername, ctx.adapter, currentUserId);
+						}
+						return { data: {
+							...user,
+							username: normalizer(username),
+							...displayUsername ? { displayUsername: displayUsernameNormalizer(displayUsername) } : {}
+						} };
+					}
 					return { data: {
 						...user,
-						...username ? { username: normalizer(username) } : {},
 						...displayUsername ? { displayUsername: displayUsernameNormalizer(displayUsername) } : {}
 					} };
 				} }
@@ -153,7 +199,7 @@ const username = (options) => {
 					if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", USERNAME_ERROR_CODES.EMAIL_NOT_VERIFIED);
 					if (ctx.context.options?.emailVerification?.sendOnSignIn) {
 						const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
-						const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${ctx.body.callbackURL || "/"}`;
+						const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 						await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 							user,
 							url,

package/dist/state.d.mts

@@ -27,8 +27,8 @@ declare function generateGenericState(c: GenericEndpointContext, stateData: Stat
   state: string;
   codeVerifier: string;
 }>;
-declare function parseGenericState(c: GenericEndpointContext, state: string, settings?: {
-  cookieName: string;
+declare function parseGenericState(c: GenericEndpointContext, state: string | undefined, settings?: {
+  cookieName?: string;
   skipStateCookieCheck?: boolean;
 }): Promise<{
   [x: string]: unknown;

package/dist/state.mjs

@@ -20,10 +20,19 @@ const stateDataSchema = z.looseObject({
 var StateError = class extends BetterAuthError {
 	code;
 	details;
+	/**
+	* The per-flow `errorCallbackURL` recovered from the parsed state, when the
+	* failure happened after the state was successfully parsed (for example a
+	* nonce or state-cookie mismatch). It was origin-validated at sign-in, so
+	* the callback can safely redirect there instead of the default error page.
+	* Absent when the state could not be parsed at all.
+	*/
+	errorURL;
 	constructor(message, options) {
 		super(message, options);
 		this.code = options.code;
 		this.details = options.details;
+		this.errorURL = options.errorURL;
 	}
 };
 async function generateGenericState(c, stateData, settings) {
@@ -62,6 +71,7 @@ async function generateGenericState(c, stateData, settings) {
 	};
 }
 async function parseGenericState(c, state, settings) {
+	if (!state) throw new StateError("State not found in OAuth callback", { code: "state_not_found" });
 	const storeStateStrategy = c.context.oauthConfig.storeStateStrategy;
 	let parsedData;
 	if (storeStateStrategy === "cookie") {
@@ -86,7 +96,8 @@ async function parseGenericState(c, state, settings) {
 		}
 		if (!parsedData.oauthState || parsedData.oauthState !== state) throw new StateError("State mismatch: OAuth state parameter does not match stored state", {
 			code: "state_security_mismatch",
-			details: { state }
+			details: { state },
+			errorURL: parsedData.errorURL
 		});
 		expireCookie(c, stateCookie);
 	} else {
@@ -98,20 +109,23 @@ async function parseGenericState(c, state, settings) {
 		parsedData = stateDataSchema.parse(JSON.parse(data.value));
 		if (parsedData.oauthState !== void 0 && parsedData.oauthState !== state) throw new StateError("State mismatch: OAuth state parameter does not match stored state", {
 			code: "state_security_mismatch",
-			details: { state }
+			details: { state },
+			errorURL: parsedData.errorURL
 		});
 		const stateCookie = c.context.createAuthCookie(settings?.cookieName ?? "state");
 		const stateCookieValue = await c.getSignedCookie(stateCookie.name, c.context.secret);
 		if (!(settings?.skipStateCookieCheck ?? c.context.oauthConfig.skipStateCookieCheck) && (!stateCookieValue || stateCookieValue !== state)) throw new StateError("State mismatch: State not persisted correctly", {
 			code: "state_security_mismatch",
-			details: { state }
+			details: { state },
+			errorURL: parsedData.errorURL
 		});
 		expireCookie(c, stateCookie);
 		await c.context.internalAdapter.deleteVerificationByIdentifier(state);
 	}
 	if (parsedData.expiresAt < Date.now()) throw new StateError("Invalid state: request expired", {
 		code: "state_mismatch",
-		details: { expiresAt: parsedData.expiresAt }
+		details: { expiresAt: parsedData.expiresAt },
+		errorURL: parsedData.errorURL
 	});
 	return parsedData;
 }

package/dist/test-utils/headers.mjs

@@ -1,3 +1,4 @@
+import { applySetCookies } from "../cookies/cookie-utils.mjs";
 //#region src/test-utils/headers.ts
 /**
 * converts set cookie containing headers to
@@ -9,13 +10,7 @@ function convertSetCookieToCookie(headers) {
 		if (name.toLowerCase() === "set-cookie") setCookieHeaders.push(value);
 	});
 	if (setCookieHeaders.length === 0) return headers;
-	const existingCookies = headers.get("cookie") || "";
-	const cookies = existingCookies ? existingCookies.split("; ") : [];
-	setCookieHeaders.forEach((setCookie) => {
-		const cookiePair = setCookie.split(";")[0];
-		cookies.push(cookiePair.trim());
-	});
-	headers.set("cookie", cookies.join("; "));
+	applySetCookies(headers, setCookieHeaders);
 	return headers;
 }
 //#endregion