better-auth 1.6.15 → 1.6.17

package/dist/oauth2/link-account.d.mts

@@ -9,6 +9,19 @@ declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
   disableSignUp?: boolean | undefined;
   overrideUserInfo?: boolean | undefined;
   isTrustedProvider?: boolean | undefined;
+  /**
+   * Whether `account.providerId` may be matched against the globally
+   * configured `accountLinking.trustedProviders` list to infer trust.
+   *
+   * Defaults to `true` for built-in social/OAuth providers, whose
+   * `providerId` namespace is controlled by the developer's config. Callers
+   * whose `providerId` is user-controlled (e.g. the SSO plugin, where any
+   * authenticated user can register a provider with an arbitrary id) must
+   * pass `false` so a provider named after a trusted social provider can't
+   * launder that trust. Such callers should supply their own
+   * `isTrustedProvider` signal instead.
+   */
+  trustProviderByName?: boolean | undefined;
 }): Promise<{
   error: string;
   data: null;

package/dist/oauth2/link-account.mjs

@@ -17,7 +17,7 @@ async function handleOAuthUserInfo(c, opts) {
 		const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.providerId === account.providerId && acc.accountId === account.accountId);
 		if (!linkedAccount) {
 			const accountLinking = c.context.options.account?.accountLinking;
-			const isTrustedProvider = opts.isTrustedProvider || c.context.trustedProviders.includes(account.providerId);
+			const isTrustedProvider = opts.isTrustedProvider || opts.trustProviderByName !== false && c.context.trustedProviders.includes(account.providerId);
 			const requireLocalEmailVerified = accountLinking?.requireLocalEmailVerified ?? true;
 			if (!isTrustedProvider && !userInfo.emailVerified || requireLocalEmailVerified && !dbUser.user.emailVerified || accountLinking?.enabled === false || accountLinking?.disableImplicitLinking === true) {
 				if (isDevelopment()) logger.warn(`User already exist but account isn't linked to ${account.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`);

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.15";
+var version = "1.6.17";
 //#endregion
 export { version };

package/dist/plugins/access/access.mjs

@@ -1,33 +1,63 @@
 import { BetterAuthError } from "@better-auth/core/error";
 //#region src/plugins/access/access.ts
+function unknownResourceResponse(requestedResource) {
+	return {
+		success: false,
+		error: `You are not allowed to access resource: ${requestedResource}`
+	};
+}
+function unauthorizedResourceResponse(requestedResource) {
+	return {
+		success: false,
+		error: `unauthorized to access resource "${requestedResource}"`
+	};
+}
+function normalizeConnector(connector) {
+	return connector === "OR" ? "OR" : "AND";
+}
+function isActionList(actions) {
+	return Array.isArray(actions);
+}
+function normalizeActionRequest(requestedActions) {
+	if (isActionList(requestedActions)) return {
+		actions: requestedActions,
+		connector: "AND"
+	};
+	if (!requestedActions || typeof requestedActions !== "object") throw new BetterAuthError("Invalid access control request");
+	const { actions, connector } = requestedActions;
+	if (!isActionList(actions)) return {
+		actions: [],
+		connector: normalizeConnector(connector)
+	};
+	return {
+		actions,
+		connector: normalizeConnector(connector)
+	};
+}
+function hasAllowedAction(allowedActions, requestedAction) {
+	return typeof requestedAction === "string" && allowedActions.includes(requestedAction);
+}
+function isResourceAuthorized(allowedActions, { actions, connector }) {
+	if (actions.length === 0) return false;
+	if (connector === "OR") return actions.some((requestedAction) => hasAllowedAction(allowedActions, requestedAction));
+	return actions.every((requestedAction) => hasAllowedAction(allowedActions, requestedAction));
+}
 function role(statements) {
 	return {
 		authorize(request, connector = "AND") {
-			let success = false;
+			let hasAuthorizedResource = false;
 			for (const [requestedResource, requestedActions] of Object.entries(request)) {
 				const allowedActions = statements[requestedResource];
 				if (!allowedActions) {
-					if (connector === "AND") return {
-						success: false,
-						error: `You are not allowed to access resource: ${requestedResource}`
-					};
-					success = false;
+					if (connector === "AND") return unknownResourceResponse(requestedResource);
 					continue;
 				}
-				if (Array.isArray(requestedActions)) success = requestedActions.length > 0 && requestedActions.every((requestedAction) => allowedActions.includes(requestedAction));
-				else if (typeof requestedActions === "object") {
-					const actions = requestedActions;
-					if (!Array.isArray(actions.actions) || actions.actions.length === 0) success = false;
-					else if (actions.connector === "OR") success = actions.actions.some((requestedAction) => allowedActions.includes(requestedAction));
-					else success = actions.actions.every((requestedAction) => allowedActions.includes(requestedAction));
-				} else throw new BetterAuthError("Invalid access control request");
-				if (success && connector === "OR") return { success };
-				if (!success && connector === "AND") return {
-					success: false,
-					error: `unauthorized to access resource "${requestedResource}"`
-				};
+				const isAuthorized = isResourceAuthorized(allowedActions, normalizeActionRequest(requestedActions));
+				if (isAuthorized) hasAuthorizedResource = true;
+				if (isAuthorized && connector === "OR") return { success: true };
+				if (!isAuthorized && connector === "AND") return unauthorizedResourceResponse(requestedResource);
 			}
-			if (success) return { success };
+			if (hasAuthorizedResource) return { success: true };
 			return {
 				success: false,
 				error: "Not authorized"

package/dist/plugins/admin/access/statement.d.mts

@@ -1,49 +1,49 @@
 import { ExactRoleStatements, Role, RoleInput, Statements } from "../../access/types.mjs";
 //#region src/plugins/admin/access/statement.d.ts
 declare const defaultStatements: {
-  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 };
 declare const defaultAc: {
   newRole<const TRoleStatements extends Statements>(statements: RoleInput<{
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }, TRoleStatements>): Role<ExactRoleStatements<TRoleStatements>, {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
   statements: {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   };
 };
 declare const adminAc: Role<ExactRoleStatements<{
-  readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+  readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
   readonly session: ["list", "revoke", "delete"];
 }>, {
-  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 }>;
 declare const userAc: Role<ExactRoleStatements<{
   readonly user: [];
   readonly session: [];
 }>, {
-  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 }>;
 declare const defaultRoles: {
   admin: Role<ExactRoleStatements<{
-    readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "set-email", "get", "update"];
     readonly session: ["list", "revoke", "delete"];
   }>, {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
   user: Role<ExactRoleStatements<{
     readonly user: [];
     readonly session: [];
   }>, {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
 };

package/dist/plugins/admin/access/statement.mjs

@@ -10,6 +10,7 @@ const defaultStatements = {
 		"impersonate-admins",
 		"delete",
 		"set-password",
+		"set-email",
 		"get",
 		"update"
 	],
@@ -29,6 +30,7 @@ const adminAc = defaultAc.newRole({
 		"impersonate",
 		"delete",
 		"set-password",
+		"set-email",
 		"get",
 		"update"
 	],

package/dist/plugins/admin/admin.d.mts

@@ -824,13 +824,13 @@ declare const admin: <O extends AdminOptions>(options?: O | undefined) => {
         $Infer: {
           body: {
             permissions: { [key in keyof (O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
               readonly session: readonly ["list", "revoke", "delete"];
             })]?: ((O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
               readonly session: readonly ["list", "revoke", "delete"];
             })[key] extends readonly unknown[] ? ArrayElement<(O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+              readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
               readonly session: readonly ["list", "revoke", "delete"];
             })[key]> : never)[] | undefined };
           } & {
@@ -866,6 +866,8 @@ declare const admin: <O extends AdminOptions>(options?: O | undefined) => {
     YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: _better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
     YOU_CANNOT_IMPERSONATE_ADMINS: _better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
     INVALID_ROLE_TYPE: _better_auth_core_utils_error_codes0.RawError<"INVALID_ROLE_TYPE">;
+    YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: _better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+    PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: _better_auth_core_utils_error_codes0.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
   };
   schema: {
     user: {
@@ -898,6 +900,7 @@ declare const admin: <O extends AdminOptions>(options?: O | undefined) => {
         impersonatedBy: {
           type: "string";
           required: false;
+          input: false;
         };
       };
     };

package/dist/plugins/admin/client.d.mts

@@ -14,7 +14,7 @@ declare const adminClient: <O extends AdminClientOptions>(options?: O | undefine
   version: string;
   $InferServerPlugin: ReturnType<typeof admin<{
     ac: O["ac"] extends AccessControl ? O["ac"] : AccessControl<{
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
       readonly session: readonly ["list", "revoke", "delete"];
     }>;
     roles: O["roles"] extends Record<string, Role> ? O["roles"] : {
@@ -28,13 +28,13 @@ declare const adminClient: <O extends AdminClientOptions>(options?: O | undefine
         roles: any;
       } ? keyof O["roles"] : "admin" | "user")>(data: {
         permissions: { [key in keyof (O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
           readonly session: readonly ["list", "revoke", "delete"];
         })]?: ((O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
           readonly session: readonly ["list", "revoke", "delete"];
         })[key] extends readonly unknown[] ? ArrayElement<(O["ac"] extends AccessControl<infer S extends Statements> ? S : {
-          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+          readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "set-email", "get", "update"];
           readonly session: readonly ["list", "revoke", "delete"];
         })[key]> : never)[] | undefined };
       } & {
@@ -73,6 +73,8 @@ declare const adminClient: <O extends AdminClientOptions>(options?: O | undefine
     YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: _better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
     YOU_CANNOT_IMPERSONATE_ADMINS: _better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
     INVALID_ROLE_TYPE: _better_auth_core_utils_error_codes0.RawError<"INVALID_ROLE_TYPE">;
+    YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: _better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+    PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: _better_auth_core_utils_error_codes0.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
   };
 };
 //#endregion

package/dist/plugins/admin/error-codes.d.mts

@@ -23,6 +23,8 @@ declare const ADMIN_ERROR_CODES: {
   YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: _better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">;
   YOU_CANNOT_IMPERSONATE_ADMINS: _better_auth_core_utils_error_codes0.RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">;
   INVALID_ROLE_TYPE: _better_auth_core_utils_error_codes0.RawError<"INVALID_ROLE_TYPE">;
+  YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: _better_auth_core_utils_error_codes0.RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
+  PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: _better_auth_core_utils_error_codes0.RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
 };
 //#endregion
 export { ADMIN_ERROR_CODES };

package/dist/plugins/admin/error-codes.mjs

@@ -21,7 +21,9 @@ const ADMIN_ERROR_CODES = defineErrorCodes({
 	YOU_CANNOT_REMOVE_YOURSELF: "You cannot remove yourself",
 	YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: "You are not allowed to set a non-existent role value",
 	YOU_CANNOT_IMPERSONATE_ADMINS: "You cannot impersonate admins",
-	INVALID_ROLE_TYPE: "Invalid role type"
+	INVALID_ROLE_TYPE: "Invalid role type",
+	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: "You are not allowed to update users email",
+	PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: "Password cannot be updated through update-user. Use the set-user-password endpoint instead"
 });
 //#endregion
 export { ADMIN_ERROR_CODES };

package/dist/plugins/admin/routes.mjs

@@ -156,14 +156,43 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 			permissions: { user: ["create"] }
 		})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS);
 	}
+	const { role: dataRole, ...userData } = ctx.body.data ?? {};
+	const requestedRole = ctx.body.role ?? dataRole;
+	if (requestedRole !== void 0) {
+		if (session) {
+			if (!hasPermission({
+				userId: session.user.id,
+				role: session.user.role,
+				options: opts,
+				permissions: { user: ["set-role"] }
+			})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE);
+		}
+		const inputRoles = Array.isArray(requestedRole) ? requestedRole : [requestedRole];
+		for (const role of inputRoles) {
+			if (typeof role !== "string") throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.INVALID_ROLE_TYPE);
+			if (opts.roles && !opts.roles[role]) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE);
+		}
+	}
+	if (session && [
+		"banned",
+		"banReason",
+		"banExpires"
+	].some((key) => Object.prototype.hasOwnProperty.call(userData, key))) {
+		if (!hasPermission({
+			userId: session.user.id,
+			role: session.user.role,
+			options: opts,
+			permissions: { user: ["ban"] }
+		})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);
+	}
 	const email = ctx.body.email.toLowerCase();
 	if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
 	if (await ctx.context.internalAdapter.findUserByEmail(email)) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);
 	const user = await ctx.context.internalAdapter.createUser({
+		...userData,
 		email,
 		name: ctx.body.name,
-		role: (ctx.body.role && parseRoles(ctx.body.role)) ?? opts?.defaultRole ?? "user",
-		...ctx.body.data
+		role: requestedRole !== void 0 ? parseRoles(requestedRole) : opts?.defaultRole ?? "user"
 	});
 	if (!user) throw APIError.from("INTERNAL_SERVER_ERROR", ADMIN_ERROR_CODES.FAILED_TO_CREATE_USER);
 	if (ctx.body.password) {
@@ -220,6 +249,9 @@ const adminUpdateUser = (opts) => createAuthEndpoint("/admin/update-user", {
 		permissions: { user: ["update"] }
 	})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS);
 	if (Object.keys(ctx.body.data).length === 0) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.NO_DATA_TO_UPDATE);
+	const updateData = ctx.body.data;
+	const hasDataKey = (key) => Object.prototype.hasOwnProperty.call(updateData, key);
+	if (hasDataKey("password")) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER);
 	if (Object.prototype.hasOwnProperty.call(ctx.body.data, "role")) {
 		if (!hasPermission({
 			userId: ctx.context.session.user.id,
@@ -235,8 +267,37 @@ const adminUpdateUser = (opts) => createAuthEndpoint("/admin/update-user", {
 		}
 		ctx.body.data.role = parseRoles(inputRoles);
 	}
+	if ([
+		"banned",
+		"banReason",
+		"banExpires"
+	].some(hasDataKey)) {
+		if (!hasPermission({
+			userId: ctx.context.session.user.id,
+			role: ctx.context.session.user.role,
+			options: opts,
+			permissions: { user: ["ban"] }
+		})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_BAN_USERS);
+		if (updateData.banned === true && ctx.body.userId === ctx.context.session.user.id) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.YOU_CANNOT_BAN_YOURSELF);
+	}
+	if (hasDataKey("email") || hasDataKey("emailVerified")) {
+		if (!hasPermission({
+			userId: ctx.context.session.user.id,
+			role: ctx.context.session.user.role,
+			options: opts,
+			permissions: { user: ["set-email"] }
+		})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL);
+		if (hasDataKey("email")) {
+			const email = String(updateData.email).toLowerCase();
+			if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
+			const existUser = await ctx.context.internalAdapter.findUserByEmail(email);
+			if (existUser && existUser.user.id !== ctx.body.userId) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);
+			updateData.email = email;
+		}
+	}
 	if (!await ctx.context.internalAdapter.findUserById(ctx.body.userId)) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const updatedUser = await ctx.context.internalAdapter.updateUser(ctx.body.userId, ctx.body.data);
+	if (updateData.banned === true) await ctx.context.internalAdapter.deleteUserSessions(ctx.body.userId);
 	return ctx.json(parseUserOutput(ctx.context.options, updatedUser));
 });
 const listUsersQuerySchema = z.object({
@@ -755,16 +816,23 @@ const setUserPassword = (opts) => createAuthEndpoint("/admin/set-user-password",
 	const { newPassword, userId } = ctx.body;
 	const minPasswordLength = ctx.context.password.config.minPasswordLength;
 	if (newPassword.length < minPasswordLength) {
-		ctx.context.logger.error("Password is too short");
+		ctx.context.logger.warn("Password is too short");
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
 	}
 	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
 	if (newPassword.length > maxPasswordLength) {
-		ctx.context.logger.error("Password is too long");
+		ctx.context.logger.warn("Password is too long");
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
 	}
+	if (!await ctx.context.internalAdapter.findUserById(userId)) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const hashedPassword = await ctx.context.password.hash(newPassword);
-	await ctx.context.internalAdapter.updatePassword(userId, hashedPassword);
+	if ((await ctx.context.internalAdapter.findAccounts(userId)).find((account) => account.providerId === "credential")) await ctx.context.internalAdapter.updatePassword(userId, hashedPassword);
+	else await ctx.context.internalAdapter.createAccount({
+		userId,
+		providerId: "credential",
+		accountId: userId,
+		password: hashedPassword
+	});
 	return ctx.json({ status: true });
 });
 const userHasPermissionBodySchema = z.object({

package/dist/plugins/admin/schema.d.mts

@@ -30,6 +30,7 @@ declare const schema: {
       impersonatedBy: {
         type: "string";
         required: false;
+        input: false;
       };
     };
   };

package/dist/plugins/admin/schema.mjs

@@ -25,7 +25,8 @@ const schema = {
 	} },
 	session: { fields: { impersonatedBy: {
 		type: "string",
-		required: false
+		required: false,
+		input: false
 	} } }
 };
 //#endregion

package/dist/plugins/captcha/constants.mjs

@@ -1,4 +1,11 @@
 //#region src/plugins/captcha/constants.ts
+/**
+* Upper bound (in milliseconds) for a single provider verification request.
+* Without it, a hanging provider would tie up the request indefinitely before
+* any rate limiting applies, so every verify handler aborts at this deadline
+* and fails closed.
+*/
+const CAPTCHA_VERIFY_TIMEOUT_MS = 1e4;
 const defaultEndpoints = [
 	"/sign-up/email",
 	"/sign-in/email",
@@ -17,4 +24,4 @@ const siteVerifyMap = {
 	[Providers.CAPTCHAFOX]: "https://api.captchafox.com/siteverify"
 };
 //#endregion
-export { Providers, defaultEndpoints, siteVerifyMap };
+export { CAPTCHA_VERIFY_TIMEOUT_MS, Providers, defaultEndpoints, siteVerifyMap };

package/dist/plugins/captcha/index.mjs

@@ -42,10 +42,16 @@ const captcha = (options) => ({
 				secretKey: options.secretKey,
 				remoteIP: remoteUserIP
 			};
-			if (options.provider === Providers.CLOUDFLARE_TURNSTILE) return await cloudflareTurnstile(handlerParams);
+			if (options.provider === Providers.CLOUDFLARE_TURNSTILE) return await cloudflareTurnstile({
+				...handlerParams,
+				expectedAction: options.expectedAction,
+				allowedHostnames: options.allowedHostnames
+			});
 			if (options.provider === Providers.GOOGLE_RECAPTCHA) return await googleRecaptcha({
 				...handlerParams,
-				minScore: options.minScore
+				minScore: options.minScore,
+				expectedAction: options.expectedAction,
+				allowedHostnames: options.allowedHostnames
 			});
 			if (options.provider === Providers.HCAPTCHA) return await hCaptcha({
 				...handlerParams,

package/dist/plugins/captcha/types.d.mts

@@ -10,9 +10,30 @@ interface BaseCaptchaOptions {
 interface GoogleRecaptchaOptions extends BaseCaptchaOptions {
   provider: typeof Providers.GOOGLE_RECAPTCHA;
   minScore?: number | undefined;
+  /**
+   * Expected reCAPTCHA v3 `action`. When set, a verification whose action does
+   * not match is rejected, preventing a token minted for another action on the
+   * same site key from being replayed against this endpoint.
+   */
+  expectedAction?: string | undefined;
+  /**
+   * Allow-list of hostnames the token must have been issued for. When set, a
+   * verification reporting a different hostname is rejected.
+   */
+  allowedHostnames?: string[] | undefined;
 }
 interface CloudflareTurnstileOptions extends BaseCaptchaOptions {
   provider: typeof Providers.CLOUDFLARE_TURNSTILE;
+  /**
+   * Expected Turnstile `action`. When set, a verification whose action does
+   * not match is rejected, preventing cross-context token reuse.
+   */
+  expectedAction?: string | undefined;
+  /**
+   * Allow-list of hostnames the token must have been issued for. When set, a
+   * verification reporting a different or missing hostname is rejected.
+   */
+  allowedHostnames?: string[] | undefined;
 }
 interface HCaptchaOptions extends BaseCaptchaOptions {
   provider: typeof Providers.HCAPTCHA;

package/dist/plugins/captcha/verify-handlers/captchafox.mjs

@@ -1,4 +1,5 @@
 import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
 import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
 import { encodeToURLParams } from "../utils.mjs";
 import { betterFetch } from "@better-fetch/fetch";
@@ -6,6 +7,7 @@ import { betterFetch } from "@better-fetch/fetch";
 const captchaFox = async ({ siteVerifyURL, captchaResponse, secretKey, siteKey, remoteIP }) => {
 	const response = await betterFetch(siteVerifyURL, {
 		method: "POST",
+		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: encodeToURLParams({
 			secret: secretKey,

package/dist/plugins/captcha/verify-handlers/cloudflare-turnstile.mjs

@@ -1,10 +1,12 @@
 import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
 import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/captcha/verify-handlers/cloudflare-turnstile.ts
-const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey, remoteIP }) => {
+const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey, remoteIP, expectedAction, allowedHostnames }) => {
 	const response = await betterFetch(siteVerifyURL, {
 		method: "POST",
+		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify({
 			secret: secretKey,
@@ -13,11 +15,14 @@ const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey,
 		})
 	});
 	if (!response.data || response.error) throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message);
-	if (!response.data.success) return middlewareResponse({
+	const verificationFailed = () => middlewareResponse({
 		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
 		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
 		status: 403
 	});
+	if (!response.data.success) return verificationFailed();
+	if (expectedAction && response.data.action !== expectedAction) return verificationFailed();
+	if (allowedHostnames && allowedHostnames.length > 0 && !(response.data.hostname && allowedHostnames.includes(response.data.hostname))) return verificationFailed();
 };
 //#endregion
 export { cloudflareTurnstile };

package/dist/plugins/captcha/verify-handlers/google-recaptcha.mjs

@@ -1,4 +1,5 @@
 import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
 import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
 import { encodeToURLParams } from "../utils.mjs";
 import { betterFetch } from "@better-fetch/fetch";
@@ -6,9 +7,10 @@ import { betterFetch } from "@better-fetch/fetch";
 const isV3 = (response) => {
 	return "score" in response && typeof response.score === "number";
 };
-const googleRecaptcha = async ({ siteVerifyURL, captchaResponse, secretKey, minScore = .5, remoteIP }) => {
+const googleRecaptcha = async ({ siteVerifyURL, captchaResponse, secretKey, minScore = .5, remoteIP, expectedAction, allowedHostnames }) => {
 	const response = await betterFetch(siteVerifyURL, {
 		method: "POST",
+		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: encodeToURLParams({
 			secret: secretKey,
@@ -17,11 +19,14 @@ const googleRecaptcha = async ({ siteVerifyURL, captchaResponse, secretKey, minS
 		})
 	});
 	if (!response.data || response.error) throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message);
-	if (!response.data.success || isV3(response.data) && response.data.score < minScore) return middlewareResponse({
+	const verificationFailed = () => middlewareResponse({
 		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
 		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
 		status: 403
 	});
+	if (!response.data.success || isV3(response.data) && response.data.score < minScore) return verificationFailed();
+	if (expectedAction && response.data.action !== expectedAction) return verificationFailed();
+	if (allowedHostnames && allowedHostnames.length > 0 && !allowedHostnames.includes(response.data.hostname)) return verificationFailed();
 };
 //#endregion
 export { googleRecaptcha };

package/dist/plugins/captcha/verify-handlers/h-captcha.mjs

@@ -1,4 +1,5 @@
 import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
 import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
 import { encodeToURLParams } from "../utils.mjs";
 import { betterFetch } from "@better-fetch/fetch";
@@ -6,6 +7,7 @@ import { betterFetch } from "@better-fetch/fetch";
 const hCaptcha = async ({ siteVerifyURL, captchaResponse, secretKey, siteKey, remoteIP }) => {
 	const response = await betterFetch(siteVerifyURL, {
 		method: "POST",
+		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: encodeToURLParams({
 			secret: secretKey,