better-auth 1.6.13 → 1.6.14

package/dist/cookies/index.mjs

@@ -199,7 +199,7 @@ const getSessionCookie = (request, config) => {
 	if (!cookies) return null;
 	const { cookieName = "session_token", cookiePrefix = "better-auth" } = config || {};
 	const parsedCookie = parseCookies(cookies);
-	const getCookie = (name) => parsedCookie.get(name) || parsedCookie.get(`__Secure-${name}`);
+	const getCookie = (name) => parsedCookie.get(`__Secure-${name}`) ?? parsedCookie.get(name);
 	const sessionToken = getCookie(`${cookiePrefix}.${cookieName}`) || getCookie(`${cookiePrefix}-${cookieName}`);
 	if (sessionToken) return sessionToken;
 	return null;

package/dist/db/to-zod.d.mts

@@ -25,8 +25,8 @@ type GetType<F extends DBFieldAttribute> = F extends {
   type: "date";
 } ? z.ZodDate : z.ZodAny;
 type GetRequired<F extends DBFieldAttribute, Schema extends z.core.SomeType> = F extends {
-  required: true;
-} ? Schema : z.ZodOptional<Schema>;
+  required: false;
+} ? z.ZodOptional<z.ZodNullable<Schema>> : Schema;
 type GetInput<isClientSide extends boolean, Field extends DBFieldAttribute, Schema extends z.core.SomeType> = Field extends {
   input: false;
 } ? isClientSide extends true ? never : Schema : Schema;

package/dist/db/to-zod.mjs

@@ -10,7 +10,7 @@ function toZodSchema({ fields, isClientSide }) {
 		else if (field.type === "string[]" || field.type === "number[]") schema = z.array(field.type === "string[]" ? z.string() : z.number());
 		else if (Array.isArray(field.type)) schema = z.any();
 		else schema = z[field.type]();
-		if (field?.required === false) schema = schema.optional();
+		if (field?.required === false) schema = schema.nullish();
 		if (!isClientSide && field?.returned === false) return acc;
 		return {
 			...acc,

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.13";
+var version = "1.6.14";
 //#endregion
 export { version };

package/dist/plugins/organization/adapter.mjs

@@ -550,9 +550,11 @@ const getOrgAdapter = (context, options) => {
 		createInvitation: async ({ invitation, user }) => {
 			const adapter = await getCurrentAdapter(baseAdapter);
 			const expiresAt = getDate(options?.invitationExpiresIn || 3600 * 48, "sec");
+			const invitationId = context.generateId({ model: "invitation" });
 			return await adapter.create({
 				model: "invitation",
 				data: {
+					...invitationId !== false ? { id: invitationId } : {},
 					status: "pending",
 					expiresAt,
 					createdAt: /* @__PURE__ */ new Date(),

package/dist/plugins/organization/routes/crud-access-control.d.mts

@@ -14,7 +14,7 @@ declare const createOrgRole: <O extends OrganizationOptions>(options: O) => bett
     role: z.ZodString;
     permission: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
     additionalFields: z.ZodOptional<z.ZodObject<{
-      [x: string]: z.ZodOptional<z.ZodAny>;
+      [x: string]: z.ZodAny;
     }, z.core.$strip>>;
   }, z.core.$strip>;
   metadata: {

package/dist/plugins/organization/routes/crud-invites.mjs

@@ -19,6 +19,20 @@ const baseInvitationSchema = z.object({
 	resend: z.boolean().meta({ description: "Resend the invitation email, if the user is already invited. Eg: true" }).optional(),
 	teamId: z.union([z.string().meta({ description: "The team ID to invite the user to" }).optional(), z.array(z.string()).meta({ description: "The team IDs to invite the user to" }).optional()])
 });
+const getAdvancedGenerateId = (advancedOptions) => {
+	if (typeof advancedOptions !== "object" || advancedOptions === null) return;
+	const generateId = advancedOptions.generateId;
+	if (typeof generateId !== "function") return;
+	return generateId;
+};
+const hasBuiltInOpaqueInvitationIdGeneration = ({ advancedGenerateId, databaseGenerateId }) => advancedGenerateId === void 0 && (databaseGenerateId === void 0 || databaseGenerateId === "uuid");
+const shouldRequireVerifiedEmailForInvitationIdAction = ({ organizationOptions, advancedGenerateId, databaseGenerateId }) => {
+	if (organizationOptions.requireEmailVerificationOnInvitation !== void 0) return organizationOptions.requireEmailVerificationOnInvitation;
+	return !hasBuiltInOpaqueInvitationIdGeneration({
+		advancedGenerateId,
+		databaseGenerateId
+	});
+};
 const createInvitation = (option) => {
 	const additionalFieldsSchema = toZodSchema({
 		fields: option?.schema?.invitation?.additionalFields || {},
@@ -247,7 +261,11 @@ const acceptInvitation = (options) => createAuthEndpoint("/organization/accept-i
 	const invitation = await adapter.findInvitationById(ctx.body.invitationId);
 	if (!invitation || invitation.expiresAt < /* @__PURE__ */ new Date() || invitation.status !== "pending") throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.INVITATION_NOT_FOUND);
 	if (invitation.email.toLowerCase() !== session.user.email.toLowerCase()) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION);
-	if ((ctx.context.orgOptions.requireEmailVerificationOnInvitation ?? true) && !session.user.emailVerified) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION);
+	if (shouldRequireVerifiedEmailForInvitationIdAction({
+		organizationOptions: ctx.context.orgOptions,
+		advancedGenerateId: getAdvancedGenerateId(ctx.context.options.advanced),
+		databaseGenerateId: ctx.context.options.advanced?.database?.generateId
+	}) && !session.user.emailVerified) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION);
 	const membershipLimit = ctx.context.orgOptions?.membershipLimit || 100;
 	const membersCount = await adapter.countMembers({ organizationId: invitation.organizationId });
 	const organization = await adapter.findOrganizationById(invitation.organizationId);
@@ -336,7 +354,11 @@ const rejectInvitation = (options) => createAuthEndpoint("/organization/reject-i
 		code: "INVITATION_NOT_FOUND"
 	});
 	if (invitation.email.toLowerCase() !== session.user.email.toLowerCase()) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION);
-	if ((ctx.context.orgOptions.requireEmailVerificationOnInvitation ?? true) && !session.user.emailVerified) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION);
+	if (shouldRequireVerifiedEmailForInvitationIdAction({
+		organizationOptions: ctx.context.orgOptions,
+		advancedGenerateId: getAdvancedGenerateId(ctx.context.options.advanced),
+		databaseGenerateId: ctx.context.options.advanced?.database?.generateId
+	}) && !session.user.emailVerified) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION);
 	const organization = await adapter.findOrganizationById(invitation.organizationId);
 	if (!organization) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND);
 	if (options?.organizationHooks?.beforeRejectInvitation) await options?.organizationHooks.beforeRejectInvitation({
@@ -455,7 +477,11 @@ const getInvitation = (options) => createAuthEndpoint("/organization/get-invitat
 	const invitation = await adapter.findInvitationById(ctx.query.id);
 	if (!invitation || invitation.status !== "pending" || invitation.expiresAt < /* @__PURE__ */ new Date()) throw APIError.fromStatus("BAD_REQUEST", { message: "Invitation not found!" });
 	if (invitation.email.toLowerCase() !== session.user.email.toLowerCase()) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION);
-	if ((ctx.context.orgOptions.requireEmailVerificationOnInvitation ?? true) && !session.user.emailVerified) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION);
+	if (shouldRequireVerifiedEmailForInvitationIdAction({
+		organizationOptions: ctx.context.orgOptions,
+		advancedGenerateId: getAdvancedGenerateId(ctx.context.options.advanced),
+		databaseGenerateId: ctx.context.options.advanced?.database?.generateId
+	}) && !session.user.emailVerified) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION);
 	const organization = await adapter.findOrganizationById(invitation.organizationId);
 	if (!organization) throw APIError.from("BAD_REQUEST", ORGANIZATION_ERROR_CODES.ORGANIZATION_NOT_FOUND);
 	const member = await adapter.findMemberByOrgId({
@@ -541,7 +567,7 @@ const listUserInvitations = (options) => createAuthEndpoint("/organization/list-
 }, async (ctx) => {
 	const session = await getSessionFromCtx(ctx);
 	if (ctx.request && ctx.query?.email) throw APIError.fromStatus("BAD_REQUEST", { message: "User email cannot be passed for client side API calls." });
-	if (session && (ctx.context.orgOptions.requireEmailVerificationOnInvitation ?? true) && !session.user.emailVerified) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION);
+	if (session && !session.user.emailVerified) throw APIError.from("FORBIDDEN", ORGANIZATION_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION);
 	const userEmail = session?.user.email || ctx.query?.email;
 	if (!userEmail) throw APIError.fromStatus("BAD_REQUEST", { message: "Missing session headers, or email query parameter." });
 	const pendingInvitations = (await getOrgAdapter(ctx.context, options).listUserInvitations(userEmail)).filter((inv) => inv.status === "pending");

package/dist/plugins/organization/types.d.mts

@@ -165,19 +165,26 @@ interface OrganizationOptions {
    */
   cancelPendingInvitationsOnReInvite?: boolean | undefined;
   /**
-   * Require email verification on session-authenticated recipient invitation
-   * calls (accept, reject, get, list). Defaults to `true` so unverified
-   * accounts registered against a victim's email cannot accept, read, or
-   * enumerate invitations targeted at that email. Server-side
-   * `listUserInvitations` calls without a session (caller passes
-   * `ctx.query.email`) continue to bypass the gate because the caller is
-   * trusted. Set to `false` for backward compatibility on apps that do not
-   * require email verification; understand the takeover risk before doing so.
+   * Require email verification before session-authenticated recipient
+   * invitation calls that carry an invitation ID (accept, reject, get).
    *
-   * @default true
+   * When unset, Better Auth preserves the normal emailed-invitation flow for
+   * built-in opaque invitation IDs, including the default generator and
+   * `advanced.database.generateId: "uuid"`. It requires verification for
+   * externally controlled or predictable invitation IDs, such as
+   * `advanced.database.generateId: "serial"` / `false` or custom ID
+   * generation.
+   *
+   * Set this option to `true` when invitation IDs may be visible outside the
+   * invited user's mailbox, when organization invitation lists are exposed to
+   * members, or when verified email should be the ownership proof for by-ID
+   * invitation actions. Client-side `listUserInvitations` calls always require
+   * a verified session email because they enumerate invitation IDs from
+   * `session.user.email`. Server-side `listUserInvitations` calls without a
+   * session (caller passes `ctx.query.email`) continue to bypass the gate
+   * because the caller is trusted.
    *
-   * @deprecated The option will be removed on the next minor; the gate will
-   * become unconditional. Plan to verify emails before invitation acceptance.
+   * @default undefined
    */
   requireEmailVerificationOnInvitation?: boolean | undefined;
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.6.13",
+  "version": "1.6.14",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -489,13 +489,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.1.1",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.6.13",
-    "@better-auth/drizzle-adapter": "1.6.13",
-    "@better-auth/kysely-adapter": "1.6.13",
-    "@better-auth/memory-adapter": "1.6.13",
-    "@better-auth/mongo-adapter": "1.6.13",
-    "@better-auth/prisma-adapter": "1.6.13",
-    "@better-auth/telemetry": "1.6.13"
+    "@better-auth/core": "1.6.14",
+    "@better-auth/drizzle-adapter": "1.6.14",
+    "@better-auth/kysely-adapter": "1.6.14",
+    "@better-auth/memory-adapter": "1.6.14",
+    "@better-auth/mongo-adapter": "1.6.14",
+    "@better-auth/prisma-adapter": "1.6.14",
+    "@better-auth/telemetry": "1.6.14"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.116.3",