better-auth 1.6.20 → 1.6.21

package/dist/api/index.d.mts

@@ -1,6 +1,5 @@
 import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
-import { getIp } from "../utils/get-request-ip.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { DispatchContext, dispatchAuthEndpoint } from "./dispatch.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
@@ -11,7 +10,7 @@ import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEm
 import { error } from "./routes/error.mjs";
 import { ok } from "./routes/ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { signInEmail, signInSocial } from "./routes/sign-in.mjs";
 import { signOut } from "./routes/sign-out.mjs";
 import { signUpEmail } from "./routes/sign-up.mjs";
@@ -24,6 +23,7 @@ import * as _better_auth_core_db0 from "@better-auth/core/db";
 import { InternalLogger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import * as _better_auth_core_oauth20 from "@better-auth/core/oauth2";
+import { getIp } from "@better-auth/core/utils/ip";
 import * as better_call0 from "better-call";
 import { AuthEndpoint, AuthMiddleware, createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
 import * as zod from "zod";
@@ -3961,4 +3961,4 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
   } extends infer T_2 ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K] } : never) & T_1> : never : never : never;
 };
 //#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -1,11 +1,10 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
-import { getIp } from "../utils/get-request-ip.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
 import { getOAuthState } from "./state/oauth.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
@@ -21,6 +20,7 @@ import { dispatchAuthEndpoint } from "./dispatch.mjs";
 import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
 import { logger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
+import { getIp } from "@better-auth/core/utils/ip";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, withSpan } from "@better-auth/core/instrumentation";
 import { normalizePathname } from "@better-auth/core/utils/url";
 import { createRouter } from "better-call";
@@ -165,6 +165,8 @@ const router = (ctx, options) => {
 			const normalizedPath = normalizePathname(req.url, basePath);
 			if (disabledPaths.includes(normalizedPath)) return new Response("Not Found", { status: 404 });
 			let currentRequest = req;
+			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
+			if (rateLimitResponse) return rateLimitResponse;
 			for (const plugin of ctx.options.plugins || []) if (plugin.onRequest) {
 				const response = await withSpan(`onRequest ${plugin.id}`, {
 					[ATTR_HOOK_TYPE]: "onRequest",
@@ -173,8 +175,6 @@ const router = (ctx, options) => {
 				if (response && "response" in response) return response.response;
 				if (response && "request" in response) currentRequest = response.request;
 			}
-			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
-			if (rateLimitResponse) return rateLimitResponse;
 			return currentRequest;
 		},
 		async onResponse(res, req) {
@@ -213,4 +213,4 @@ const router = (ctx, options) => {
 	});
 };
 //#endregion
-export { APIError, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/rate-limiter/index.mjs

@@ -1,8 +1,7 @@
 import { wildcardMatch } from "../../utils/wildcard.mjs";
-import { getIp } from "../../utils/get-request-ip.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { createRateLimitKey, getIp } from "@better-auth/core/utils/ip";
 import { normalizePathname } from "@better-auth/core/utils/url";
-import { createRateLimitKey } from "@better-auth/core/utils/ip";
 //#region src/api/rate-limiter/index.ts
 const memory = /* @__PURE__ */ new Map();
 const MEMORY_STORE_MAX_ENTRIES = 1e5;
@@ -282,7 +281,7 @@ async function resolveRateLimitConfig(req, ctx) {
 	const ip = getIp(req, ctx.options);
 	if (!ip && ctx.options.advanced?.ipAddress?.disableIpTracking) return null;
 	if (!ip && !ipWarningLogged) {
-		ctx.logger.warn("Rate limiting could not determine a client IP and is falling back to a single shared per-path bucket. Ensure your runtime forwards a trusted client IP header and configure `advanced.ipAddress.ipAddressHeaders` if needed.");
+		ctx.logger.warn("Rate limiting could not determine a client IP and is falling back to a single shared per-path bucket. Ensure your runtime forwards a trusted client IP header, then set `advanced.ipAddress.ipAddressHeaders` or `advanced.ipAddress.trustedProxies` so the address can be resolved.");
 		ipWarningLogged = true;
 	}
 	const key = createRateLimitKey(ip ?? NO_TRUSTED_IP_KEY, path);

package/dist/api/routes/index.d.mts

@@ -4,7 +4,7 @@ import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEm
 import { error } from "./error.mjs";
 import { ok } from "./ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./password.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
 import { signInEmail, signInSocial } from "./sign-in.mjs";
 import { signOut } from "./sign-out.mjs";
 import { signUpEmail } from "./sign-up.mjs";

package/dist/api/routes/session.d.mts

@@ -63,6 +63,34 @@ declare const getSessionFromCtx: <U extends Record<string, any> = Record<string,
   session: S & Session$1;
   user: U & User$1;
 } | null>;
+/**
+ * Reads the session from the source that can authorize sensitive work.
+ *
+ * Stateful deployments must re-read the server-side session store because an
+ * earlier hook may have populated `ctx.context.session` from cookie cache.
+ * Stateless deployments keep the signed cookie as the session record.
+ */
+declare const getAuthoritativeSessionFromCtx: <U extends Record<string, any> = Record<string, any>, S extends Record<string, any> = Record<string, any>>(ctx: GenericEndpointContext) => Promise<{
+  session: S & {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null | undefined;
+    userAgent?: string | null | undefined;
+  };
+  user: U & {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null | undefined;
+  };
+} | null>;
 /**
  * The middleware forces the endpoint to require a valid session.
  */
@@ -90,9 +118,8 @@ declare const sessionMiddleware: (inputContext: better_call0.MiddlewareInputCont
   };
 }>;
 /**
- * This middleware forces the endpoint to require a valid session and ignores cookie cache.
+ * This middleware forces the endpoint to require a valid authoritative session.
  * This should be used for sensitive operations like password changes, account deletion, etc.
- * to ensure that revoked sessions cannot be used even if they're still cached in cookies.
  */
 declare const sensitiveSessionMiddleware: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
   session: {
@@ -420,4 +447,4 @@ declare const revokeOtherSessions: better_call0.StrictEndpoint<"/revoke-other-se
   status: boolean;
 }>;
 //#endregion
-export { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };
+export { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };

package/dist/api/routes/session.mjs

@@ -299,6 +299,18 @@ const getSessionFromCtx = async (ctx, config) => {
 	return session.response;
 };
 /**
+* Reads the session from the source that can authorize sensitive work.
+*
+* Stateful deployments must re-read the server-side session store because an
+* earlier hook may have populated `ctx.context.session` from cookie cache.
+* Stateless deployments keep the signed cookie as the session record.
+*/
+const getAuthoritativeSessionFromCtx = async (ctx) => {
+	if (!isStateful(ctx)) return getSessionFromCtx(ctx);
+	ctx.context.session = null;
+	return getSessionFromCtx(ctx, { disableCookieCache: true });
+};
+/**
 * The middleware forces the endpoint to require a valid session.
 */
 const sessionMiddleware = createAuthMiddleware(async (ctx) => {
@@ -310,12 +322,11 @@ const sessionMiddleware = createAuthMiddleware(async (ctx) => {
 	return { session };
 });
 /**
-* This middleware forces the endpoint to require a valid session and ignores cookie cache.
+* This middleware forces the endpoint to require a valid authoritative session.
 * This should be used for sensitive operations like password changes, account deletion, etc.
-* to ensure that revoked sessions cannot be used even if they're still cached in cookies.
 */
 const sensitiveSessionMiddleware = createAuthMiddleware(async (ctx) => {
-	const session = await getSessionFromCtx(ctx, { disableCookieCache: true });
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session?.session) throw APIError.from("UNAUTHORIZED", {
 		message: "Unauthorized",
 		code: "UNAUTHORIZED"
@@ -491,4 +502,4 @@ const revokeOtherSessions = createAuthEndpoint("/revoke-other-sessions", {
 	return ctx.json({ status: true });
 });
 //#endregion
-export { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };
+export { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };

package/dist/context/create-context.mjs

@@ -16,6 +16,7 @@ import { createLogger, env, isProduction, isTest } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { socialProviders } from "@better-auth/core/social-providers";
+import { findInvalidTrustedProxies } from "@better-auth/core/utils/ip";
 import { createTelemetry } from "@better-auth/telemetry";
 import defu$1 from "defu";
 //#region src/context/create-context.ts
@@ -86,6 +87,11 @@ Most of the features of Better Auth will not work correctly.`);
 		plugins: plugins.concat(internalPlugins)
 	};
 	checkEndpointConflicts(options, logger);
+	const trustedProxies = options.advanced?.ipAddress?.trustedProxies;
+	if (trustedProxies && trustedProxies.length > 0) {
+		const invalid = findInvalidTrustedProxies(trustedProxies);
+		if (invalid.length > 0) logger.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${invalid.join(", ")}. Each entry must be an IP address or CIDR range.`);
+	}
 	const cookies = getCookies(options);
 	const tables = getAuthTables(options);
 	const providers = (await Promise.all(Object.entries(options.socialProviders || {}).map(async ([key, originalConfig]) => {

package/dist/db/get-migration.mjs

@@ -148,6 +148,7 @@ async function getMigrations(config) {
 	const toBeCreated = [];
 	const toBeAdded = [];
 	for (const [key, value] of Object.entries(betterAuthSchema)) {
+		if (value.disableMigrations) continue;
 		const table = tableMetadata.find((t) => t.name === key);
 		if (!table) {
 			const tIndex = toBeCreated.findIndex((t) => t.table === key);

package/dist/db/get-schema.d.mts

@@ -5,6 +5,7 @@ import { DBFieldAttribute } from "@better-auth/core/db";
 declare function getSchema(config: BetterAuthOptions): Record<string, {
   fields: Record<string, DBFieldAttribute>;
   order: number;
+  disableMigrations?: boolean | undefined;
 }>;
 //#endregion
 export { getSchema };

package/dist/db/get-schema.mjs

@@ -23,11 +23,13 @@ function getSchema(config) {
 				...schema[table.modelName].fields,
 				...actualFields
 			};
+			if (table.disableMigrations) schema[table.modelName].disableMigrations = true;
 			continue;
 		}
 		schema[table.modelName] = {
 			fields: actualFields,
-			order: table.order || Infinity
+			order: table.order || Infinity,
+			disableMigrations: table.disableMigrations
 		};
 	}
 	return schema;

package/dist/db/index.d.mts

@@ -3,7 +3,7 @@ import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getSchema } from "./get-schema.mjs";
 import { DatabaseHooksEntry, getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
-import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
+import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
 import { FieldAttributeToSchema, toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
-export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };

package/dist/db/index.mjs

@@ -1,6 +1,6 @@
 import { __exportAll, __reExport } from "../_virtual/_rolldown/runtime.mjs";
 import { getSchema } from "./get-schema.mjs";
-import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
+import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
 import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
@@ -19,6 +19,7 @@ var db_exports = /* @__PURE__ */ __exportAll({
 	parseAccountInput: () => parseAccountInput,
 	parseAccountOutput: () => parseAccountOutput,
 	parseAdditionalUserInput: () => parseAdditionalUserInput,
+	parseAdditionalUserInputFromProviderProfile: () => parseAdditionalUserInputFromProviderProfile,
 	parseInputData: () => parseInputData,
 	parseSessionInput: () => parseSessionInput,
 	parseSessionOutput: () => parseSessionOutput,
@@ -29,4 +30,4 @@ var db_exports = /* @__PURE__ */ __exportAll({
 import * as import__better_auth_core_db from "@better-auth/core/db";
 __reExport(db_exports, import__better_auth_core_db);
 //#endregion
-export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };

package/dist/db/internal-adapter.mjs

@@ -1,4 +1,3 @@
-import { getIp } from "../utils/get-request-ip.mjs";
 import { getSessionDefaultFields, parseSessionOutput, parseUserOutput } from "./schema.mjs";
 import { getDate } from "../utils/date.mjs";
 import { getStorageOption, processIdentifier } from "./verification-token-storage.mjs";
@@ -6,6 +5,7 @@ import { getWithHooks } from "./with-hooks.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, runWithTransaction } from "@better-auth/core/context";
 import { generateId } from "@better-auth/core/utils/id";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { getIp } from "@better-auth/core/utils/ip";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 //#region src/db/internal-adapter.ts

package/dist/db/schema.d.mts

@@ -24,6 +24,7 @@ declare function parseInputData<T extends Record<string, any>>(data: T, schema:
   action?: ("create" | "update") | undefined;
 }): Partial<T>;
 declare function parseUserInput(options: BetterAuthOptions, user: Record<string, any> | undefined, action: "create" | "update"): Partial<Record<string, any>>;
+declare function parseAdditionalUserInputFromProviderProfile(options: BetterAuthOptions, profile: Record<string, unknown> | undefined, action: "create" | "update"): Partial<Record<string, unknown>>;
 declare function parseAdditionalUserInput(options: BetterAuthOptions, user?: Record<string, any> | undefined): Partial<Record<string, any>>;
 declare function parseAccountInput(options: BetterAuthOptions, account: Partial<Account>): Partial<Partial<{
   id: string;
@@ -58,4 +59,4 @@ declare function mergeSchema<S extends BetterAuthPluginDBSchema>(schema: S, newS
   } | undefined;
 } | undefined } | undefined): S;
 //#endregion
-export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };
+export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/db/schema.mjs

@@ -113,6 +113,18 @@ function parseUserInput(options, user = {}, action) {
 		action
 	});
 }
+function parseAdditionalUserInputFromProviderProfile(options, profile = {}, action) {
+	const schema = getFields(options, "user", "input");
+	const allowedProfileFields = Object.create(null);
+	for (const key of Object.keys(profile)) {
+		if (schema[key]?.input === false) continue;
+		allowedProfileFields[key] = profile[key];
+	}
+	return parseInputData(allowedProfileFields, {
+		fields: schema,
+		action
+	});
+}
 function parseAdditionalUserInput(options, user) {
 	const schema = getFields(options, "user", "input");
 	return parseInputData(user || {}, { fields: schema });
@@ -146,4 +158,4 @@ function mergeSchema(schema, newSchema) {
 	return schema;
 }
 //#endregion
-export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };
+export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/oauth2/link-account.mjs

@@ -1,4 +1,5 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
+import { parseAdditionalUserInputFromProviderProfile } from "../db/schema.mjs";
 import { setAccountCookie } from "../cookies/session-store.mjs";
 import { redirectOnError } from "./errors.mjs";
 import { setTokenUtil } from "./utils.mjs";
@@ -64,9 +65,12 @@ async function handleOAuthUserInfo(c, opts) {
 			if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
 		}
 		if (overrideUserInfo) {
-			const { id: _, ...restUserInfo } = userInfo;
+			const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+			const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "update");
 			user = await c.context.internalAdapter.updateUser(dbUser.user.id, {
-				...restUserInfo,
+				name,
+				image,
+				...additionalUserFields,
 				email: userInfo.email.toLowerCase(),
 				emailVerified: userInfo.email.toLowerCase() === dbUser.user.email ? dbUser.user.emailVerified || userInfo.emailVerified : userInfo.emailVerified
 			});
@@ -78,7 +82,8 @@ async function handleOAuthUserInfo(c, opts) {
 			isRegister: false
 		};
 		try {
-			const { id: _, ...restUserInfo } = userInfo;
+			const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+			const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "create");
 			const accountData = {
 				accessToken: await setTokenUtil(account.accessToken, c.context),
 				refreshToken: await setTokenUtil(account.refreshToken, c.context),
@@ -90,8 +95,11 @@ async function handleOAuthUserInfo(c, opts) {
 				accountId: userInfo.id.toString()
 			};
 			const { user: createdUser, account: createdAccount } = await c.context.internalAdapter.createOAuthUser({
-				...restUserInfo,
-				email: userInfo.email.toLowerCase()
+				name,
+				image,
+				...additionalUserFields,
+				email: userInfo.email.toLowerCase(),
+				emailVerified: userInfo.emailVerified
 			}, accountData);
 			user = createdUser;
 			if (c.context.options.account?.storeAccountCookie) await setAccountCookie(c, createdAccount);
@@ -152,9 +160,14 @@ async function handleOAuthUserInfo(c, opts) {
 */
 async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
 	if (c.context.options.account?.accountLinking?.updateUserInfoOnLink !== true) return;
-	const { id: _id, email: _email, emailVerified: _emailVerified, ...profile } = userInfo;
 	try {
-		return await c.context.internalAdapter.updateUser(userId, profile);
+		const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+		const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "update");
+		return await c.context.internalAdapter.updateUser(userId, {
+			name,
+			image,
+			...additionalUserFields
+		});
 	} catch (e) {
 		c.context.logger.warn("Could not update user info on account link", e);
 		return;

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.20";
+var version = "1.6.21";
 //#endregion
 export { version };

package/dist/plugins/admin/routes.mjs

@@ -1,7 +1,7 @@
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermission } from "./has-permission.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -14,7 +14,7 @@ import * as z from "zod";
 * Will also provide additional types on the user to include role types.
 */
 const adminMiddleware = createAuthMiddleware(async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) throw APIError.fromStatus("UNAUTHORIZED");
 	return { session };
 });
@@ -146,7 +146,7 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 		$Infer: { body: {} }
 	}
 }, async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session && (ctx.request || ctx.headers)) throw ctx.error("UNAUTHORIZED");
 	if (session) {
 		if (!hasPermission({
@@ -885,7 +885,7 @@ const userHasPermission = (opts) => {
 		}
 	}, async (ctx) => {
 		if (!ctx.body?.permissions) throw new APIError("BAD_REQUEST", { message: "invalid permission check. no permission(s) were passed." });
-		const session = await getSessionFromCtx(ctx);
+		const session = await getAuthoritativeSessionFromCtx(ctx);
 		if (!session && (ctx.request || ctx.headers)) throw new APIError("UNAUTHORIZED");
 		if (!session && !ctx.body.userId && !ctx.body.role) throw new APIError("BAD_REQUEST", { message: "user id or role is required" });
 		const user = session?.user || (ctx.body.role ? {

package/dist/plugins/captcha/index.mjs

@@ -1,4 +1,3 @@
-import { getIp } from "../../utils/get-request-ip.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { middlewareResponse } from "../../utils/middleware-response.mjs";
 import { Providers, defaultEndpoints, siteVerifyMap } from "./constants.mjs";
@@ -7,6 +6,7 @@ import { captchaFox } from "./verify-handlers/captchafox.mjs";
 import { cloudflareTurnstile } from "./verify-handlers/cloudflare-turnstile.mjs";
 import { googleRecaptcha } from "./verify-handlers/google-recaptcha.mjs";
 import { hCaptcha } from "./verify-handlers/h-captcha.mjs";
+import { getIp } from "@better-auth/core/utils/ip";
 //#region src/plugins/captcha/index.ts
 const captcha = (options) => ({
 	id: "captcha",

package/dist/plugins/device-authorization/index.d.mts

@@ -21,7 +21,7 @@ declare const deviceAuthorizationOptionsSchema: z.ZodObject<{
   validateClient: z.ZodOptional<z.ZodCustom<(clientId: string) => boolean | Promise<boolean>, (clientId: string) => boolean | Promise<boolean>>>;
   onDeviceAuthRequest: z.ZodOptional<z.ZodCustom<(clientId: string, scope: string | undefined) => void | Promise<void>, (clientId: string, scope: string | undefined) => void | Promise<void>>>;
   verificationUri: z.ZodOptional<z.ZodString>;
-  schema: z.ZodCustom<{
+  schema: z.ZodOptional<z.ZodCustom<{
     deviceCode?: {
       modelName?: string | undefined;
       fields?: {
@@ -51,7 +51,7 @@ declare const deviceAuthorizationOptionsSchema: z.ZodObject<{
         scope?: string | undefined;
       } | undefined;
     } | undefined;
-  }>;
+  }>>;
 }, z.core.$strip>;
 type DeviceAuthorizationOptions = z.infer<typeof deviceAuthorizationOptionsSchema>;
 declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions>) => {
@@ -399,7 +399,12 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
     interval: TimeString;
     deviceCodeLength: number;
     userCodeLength: number;
-    schema: {
+    generateDeviceCode?: (() => string | Promise<string>) | undefined;
+    generateUserCode?: (() => string | Promise<string>) | undefined;
+    validateClient?: ((clientId: string) => boolean | Promise<boolean>) | undefined;
+    onDeviceAuthRequest?: ((clientId: string, scope: string | undefined) => void | Promise<void>) | undefined;
+    verificationUri?: string | undefined;
+    schema?: {
       deviceCode?: {
         modelName?: string | undefined;
         fields?: {
@@ -414,12 +419,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
           scope?: string | undefined;
         } | undefined;
       } | undefined;
-    };
-    generateDeviceCode?: (() => string | Promise<string>) | undefined;
-    generateUserCode?: (() => string | Promise<string>) | undefined;
-    validateClient?: ((clientId: string) => boolean | Promise<boolean>) | undefined;
-    onDeviceAuthRequest?: ((clientId: string, scope: string | undefined) => void | Promise<void>) | undefined;
-    verificationUri?: string | undefined;
+    } | undefined;
   }>;
 };
 //#endregion

package/dist/plugins/device-authorization/index.mjs

@@ -25,7 +25,7 @@ const deviceAuthorizationOptionsSchema = z.object({
 	validateClient: z.custom((val) => typeof val === "function", { message: "validateClient must be a function that returns a boolean or a promise that resolves to a boolean." }).optional().describe("Function to validate the client ID. If not provided, no validation will be performed."),
 	onDeviceAuthRequest: z.custom((val) => typeof val === "function", { message: "onDeviceAuthRequest must be a function that returns void or a promise that resolves to void." }).optional().describe("Function to handle device authorization requests. If not provided, no additional actions will be taken."),
 	verificationUri: z.string().optional().describe("The URI where users verify their device code. Can be an absolute URL (https://example.com/device) or relative path (/custom-path). This will be returned as verification_uri in the device code response. If not provided, defaults to /device."),
-	schema: z.custom(() => true)
+	schema: z.custom(() => true).optional()
 });
 const deviceAuthorization = (options = {}) => {
 	const opts = deviceAuthorizationOptionsSchema.parse(options);

package/dist/plugins/magic-link/index.d.mts

@@ -22,9 +22,9 @@ interface MagicLinkOptions {
    * @deprecated Multi-attempt verification is no longer supported. Each
    * magic link token is consumed atomically on the first verification call,
    * so a given token mints at most one session regardless of this value
-   * (see GHSA-hc7v-rggr-4hvx). The option is kept for source compatibility
-   * and may be removed in a future major; any value other than `1` is
-   * ignored and emits a `console.warn` at plugin construction.
+   * The option is kept for source compatibility and may be removed in a future
+   * major; any value other than `1` is ignored and emits a `console.warn` at
+   * plugin construction.
    *
    * @default 1
    */

package/dist/plugins/magic-link/index.mjs

@@ -27,7 +27,7 @@ const magicLink = (options) => {
 		allowedAttempts: 1,
 		...options
 	};
-	if (options.allowedAttempts !== void 0 && options.allowedAttempts !== 1) console.warn("[better-auth/magic-link] `allowedAttempts` is ignored: tokens are consumed atomically on the first verification call (GHSA-hc7v-rggr-4hvx). Any value other than `1` has no effect; remove the option to silence this warning.");
+	if (options.allowedAttempts !== void 0 && options.allowedAttempts !== 1) console.warn("[better-auth/magic-link] `allowedAttempts` is ignored: tokens are consumed atomically on the first verification call. Any value other than `1` has no effect; remove the option to silence this warning.");
 	async function storeToken(ctx, token) {
 		if (opts.storeToken === "hashed") return await defaultKeyHasher(token);
 		if (typeof opts.storeToken === "object" && "type" in opts.storeToken && opts.storeToken.type === "custom-hasher") return await opts.storeToken.hash(token);

package/dist/plugins/oauth-proxy/index.mjs

@@ -14,6 +14,15 @@ import { defu } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/oauth-proxy/index.ts
+const consumeOAuthProxyState = async (ctx, state) => {
+	try {
+		await parseGenericState(ctx, state, { skipStateCookieCheck: true });
+		return true;
+	} catch (e) {
+		ctx.context.logger.warn("OAuth proxy state missing or invalid", e);
+		return false;
+	}
+};
 const oauthProxyQuerySchema = z.object({
 	callbackURL: z.string().meta({ description: "The URL to redirect to after the proxy" }),
 	profile: z.string().optional().meta({ description: "Encrypted OAuth profile data" })
@@ -81,7 +90,7 @@ const oAuthProxy = (opts) => {
 				ctx.context.logger.error("Failed to parse OAuth proxy payload", e);
 				throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
 			}
-			if (typeof payload.timestamp !== "number" || !payload.userInfo || !payload.account || !payload.callbackURL) {
+			if (typeof payload.timestamp !== "number" || !payload.userInfo || !payload.account || !payload.state || !payload.callbackURL) {
 				ctx.context.logger.error("Failed to parse OAuth proxy payload");
 				throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
 			}
@@ -91,11 +100,7 @@ const oAuthProxy = (opts) => {
 				ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
 				throw redirectOnError(ctx, errorURL, "payload_expired");
 			}
-			try {
-				await parseGenericState(ctx, payload.state, { skipStateCookieCheck: true });
-			} catch (e) {
-				ctx.context.logger.warn("Failed to clean up OAuth state", e);
-			}
+			if (!await consumeOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
 			let result;
 			try {
 				result = await handleOAuthUserInfo(ctx, {

package/dist/plugins/one-tap/index.mjs

@@ -4,9 +4,9 @@ import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { toBoolean } from "../../utils/boolean.mjs";
+import { isGoogleHostedDomainAllowed, verifyGoogleIdToken } from "@better-auth/core/social-providers";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
-import { createRemoteJWKSet, jwtVerify } from "jose";
 //#region src/plugins/one-tap/index.ts
 const oneTapCallbackBodySchema = z.object({
 	idToken: z.string().meta({ description: "Google ID token, which the client obtains from the One Tap API" }),
@@ -40,14 +40,15 @@ const oneTap = (options) => ({
 		const googleProvider = typeof ctx.context.options.socialProviders?.google === "function" ? await ctx.context.options.socialProviders?.google() : ctx.context.options.socialProviders?.google;
 		const audience = options?.clientId || googleProvider?.clientId;
 		if (!audience || Array.isArray(audience) && audience.length === 0) throw new APIError("BAD_REQUEST", { message: "Google client ID is required for One Tap. Set it on the oneTap plugin (clientId) or on socialProviders.google." });
-		let payload;
-		try {
-			const { payload: verifiedPayload } = await jwtVerify(idToken, createRemoteJWKSet(new URL("https://www.googleapis.com/oauth2/v3/certs")), {
-				issuer: ["https://accounts.google.com", "accounts.google.com"],
-				audience
-			});
-			payload = verifiedPayload;
-		} catch {
+		const payload = await verifyGoogleIdToken({
+			token: idToken,
+			audience
+		});
+		if (!payload) throw new APIError("BAD_REQUEST", { message: "invalid id token" });
+		if (!payload.sub) throw new APIError("BAD_REQUEST", { message: "invalid id token" });
+		const configuredHostedDomain = googleProvider?.hd;
+		if (!isGoogleHostedDomainAllowed(configuredHostedDomain, payload.hd)) {
+			ctx.context.logger.error(`Google One Tap sign-in rejected: id token hosted domain (hd) "${payload.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${configuredHostedDomain}".`);
 			throw new APIError("BAD_REQUEST", { message: "invalid id token" });
 		}
 		const { email: rawEmail, email_verified, name, picture, sub } = payload;

package/dist/plugins/siwe/index.mjs

@@ -166,7 +166,11 @@ const siwe = (options) => {
 					}
 					if (!user) {
 						const domain = options.emailDomainName ?? getOrigin(ctx.context.baseURL);
-						const userEmail = !isAnon && email ? email : `${walletAddress}@${domain}`;
+						const normalizedEmail = email?.toLowerCase();
+						let userEmail = `${walletAddress}@${domain}`;
+						if (!isAnon && normalizedEmail) {
+							if (!await ctx.context.internalAdapter.findUserByEmail(normalizedEmail)) userEmail = normalizedEmail;
+						}
 						const { name, avatar } = await options.ensLookup?.({ walletAddress }) ?? {};
 						user = await ctx.context.internalAdapter.createUser({
 							name: name ?? walletAddress,

package/dist/plugins/two-factor/backup-codes/index.mjs

@@ -161,8 +161,9 @@ const backupCode2fa = (opts) => {
 					} }
 				} }
 			}, async (ctx) => {
-				const { session, valid } = await verifyTwoFactor(ctx);
+				const { session, valid, beginAttempt } = await verifyTwoFactor(ctx);
 				const user = session.user;
+				const isSignIn = !session.session;
 				const twoFactor = await ctx.context.adapter.findOne({
 					model: twoFactorTable,
 					where: [{
@@ -171,11 +172,21 @@ const backupCode2fa = (opts) => {
 					}]
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.BACKUP_CODES_NOT_ENABLED);
-				const validate = await verifyBackupCode({
-					backupCodes: twoFactor.backupCodes,
-					code: ctx.body.code
-				}, ctx.context.secretConfig, opts);
-				if (!validate.status || !validate.updated) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE);
+				const attempt = isSignIn ? await beginAttempt(5) : null;
+				let validate;
+				try {
+					validate = await verifyBackupCode({
+						backupCodes: twoFactor.backupCodes,
+						code: ctx.body.code
+					}, ctx.context.secretConfig, opts);
+				} catch (error) {
+					await attempt?.restore();
+					throw error;
+				}
+				if (!validate.status || !validate.updated) {
+					await attempt?.recordFailure();
+					throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_BACKUP_CODE);
+				}
 				const updatedBackupCodes = await encodeBackupCodes(validate.updated, ctx.context.secretConfig, opts);
 				if (!await ctx.context.adapter.incrementOne({
 					model: twoFactorTable,

package/dist/plugins/two-factor/index.mjs

@@ -236,10 +236,16 @@ const twoFactor = (options) => {
 				const maxAge = options?.twoFactorCookieMaxAge ?? 600;
 				const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME, { maxAge });
 				const identifier = `2fa-${generateRandomString(20)}`;
+				const expiresAt = new Date(Date.now() + maxAge * 1e3);
 				await ctx.context.internalAdapter.createVerificationValue({
 					value: data.user.id,
 					identifier,
-					expiresAt: new Date(Date.now() + maxAge * 1e3)
+					expiresAt
+				});
+				await ctx.context.internalAdapter.createVerificationValue({
+					value: "0",
+					identifier: `2fa-attempts-${identifier}`,
+					expiresAt
 				});
 				await ctx.setSignedCookie(twoFactorCookie.name, identifier, ctx.context.secret, twoFactorCookie.attributes);
 				const twoFactorMethods = [];

package/dist/plugins/two-factor/totp/index.mjs

@@ -122,7 +122,7 @@ const totp2fa = (options) => {
 						code: "TOTP_NOT_CONFIGURED"
 					});
 				}
-				const { session, valid, invalid } = await verifyTwoFactor(ctx);
+				const { session, valid, invalid, beginAttempt } = await verifyTwoFactor(ctx);
 				const user = session.user;
 				const isSignIn = !session.session;
 				const twoFactor = await ctx.context.adapter.findOne({
@@ -134,13 +134,24 @@ const totp2fa = (options) => {
 				});
 				if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
 				if (isSignIn && twoFactor.verified === false) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
-				if (!await createOTP(await symmetricDecrypt({
-					key: ctx.context.secretConfig,
-					data: twoFactor.secret
-				}), {
-					period: opts.period,
-					digits: opts.digits
-				}).verify(ctx.body.code)) return invalid("INVALID_CODE");
+				const attempt = isSignIn ? await beginAttempt(5) : null;
+				let status;
+				try {
+					status = await createOTP(await symmetricDecrypt({
+						key: ctx.context.secretConfig,
+						data: twoFactor.secret
+					}), {
+						period: opts.period,
+						digits: opts.digits
+					}).verify(ctx.body.code);
+				} catch (error) {
+					await attempt?.restore();
+					throw error;
+				}
+				if (!status) {
+					await attempt?.recordFailure();
+					return invalid("INVALID_CODE");
+				}
 				if (twoFactor.verified !== true) {
 					if (!user.twoFactorEnabled) {
 						const activeSession = session.session;

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -66,7 +66,28 @@ async function verifyTwoFactor(ctx) {
 				session: null,
 				user
 			},
-			key: signedTwoFactorCookie
+			key: signedTwoFactorCookie,
+			beginAttempt: async (allowedAttempts) => {
+				const identifier = `2fa-attempts-${signedTwoFactorCookie}`;
+				const consumed = await ctx.context.internalAdapter.consumeVerificationValue(identifier).catch(() => null);
+				if (!consumed) throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES.INVALID_TWO_FACTOR_COOKIE);
+				const parsed = Number(consumed.value);
+				const attempts = Number.isInteger(parsed) && parsed >= 0 ? parsed : allowedAttempts;
+				if (attempts >= allowedAttempts) {
+					await ctx.context.internalAdapter.consumeVerificationValue(signedTwoFactorCookie).catch(() => {});
+					expireCookie(ctx, twoFactorCookie);
+					throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOO_MANY_ATTEMPTS_REQUEST_NEW_CODE);
+				}
+				const rearm = (count) => ctx.context.internalAdapter.createVerificationValue({
+					value: `${count}`,
+					identifier,
+					expiresAt: verificationToken.expiresAt
+				}).catch(() => {});
+				return {
+					recordFailure: () => rearm(attempts + 1),
+					restore: () => rearm(attempts)
+				};
+			}
 		};
 	}
 	return {
@@ -78,7 +99,11 @@ async function verifyTwoFactor(ctx) {
 		},
 		invalid,
 		session,
-		key: `${session.user.id}!${session.session.id}`
+		key: `${session.user.id}!${session.session.id}`,
+		beginAttempt: async (_allowedAttempts) => ({
+			recordFailure: async () => {},
+			restore: async () => {}
+		})
 	};
 }
 //#endregion

package/dist/plugins/username/index.mjs

@@ -32,11 +32,17 @@ const username = (options) => {
 	const maxUsernameLength = options?.maxUsernameLength || 30;
 	const validator = options?.usernameValidator || defaultUsernameValidator;
 	const pathsWithHttpHookValidation = ["/sign-up/email", "/update-user"];
+	const getUsernameToValidate = (username) => options?.validationOrder?.username === "post-normalization" ? normalizer(username) : username;
+	async function validateUsernameValue(username) {
+		const usernameToValidate = getUsernameToValidate(username);
+		if (usernameToValidate.length < minUsernameLength) return USERNAME_ERROR_CODES.USERNAME_TOO_SHORT;
+		if (usernameToValidate.length > maxUsernameLength) return USERNAME_ERROR_CODES.USERNAME_TOO_LONG;
+		if (!await validator(usernameToValidate)) return USERNAME_ERROR_CODES.INVALID_USERNAME;
+		return null;
+	}
 	async function validateUsername(username, displayUsername, adapter, currentUserId) {
-		const usernameToValidate = options?.validationOrder?.username === "post-normalization" ? normalizer(username) : username;
-		if (usernameToValidate.length < minUsernameLength) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_TOO_SHORT);
-		if (usernameToValidate.length > maxUsernameLength) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
-		if (!await validator(usernameToValidate)) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.INVALID_USERNAME);
+		const validationError = await validateUsernameValue(username);
+		if (validationError) throw APIError.from("BAD_REQUEST", validationError);
 		const normalizedUsername = normalizer(username);
 		const existingUser = await adapter.findOne({
 			model: "user",
@@ -247,48 +253,56 @@ const username = (options) => {
 			username: normalizer,
 			displayUsername: displayUsernameNormalizer
 		}), options?.schema),
-		hooks: { before: [{
-			matcher(context) {
-				return context.path === "/sign-up/email" || context.path === "/update-user";
+		hooks: { before: [
+			{
+				matcher(context) {
+					return context.path === "/sign-up/email";
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					if (typeof ctx.body.displayUsername !== "string" || ctx.body.username !== void 0) return;
+					if (!await validateUsernameValue(ctx.body.displayUsername)) ctx.body.username = ctx.body.displayUsername;
+				})
 			},
-			handler: createAuthMiddleware(async (ctx) => {
-				const username = typeof ctx.body.username === "string" && options?.validationOrder?.username === "post-normalization" ? normalizer(ctx.body.username) : ctx.body.username;
-				if (username !== void 0 && typeof username === "string") {
-					const minUsernameLength = options?.minUsernameLength || 3;
-					const maxUsernameLength = options?.maxUsernameLength || 30;
-					if (username.length < minUsernameLength) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_TOO_SHORT);
-					if (username.length > maxUsernameLength) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
-					if (!await (options?.usernameValidator || defaultUsernameValidator)(username)) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.INVALID_USERNAME);
-					const normalizedUsername = normalizer(ctx.body.username);
-					const existingUser = await ctx.context.adapter.findOne({
-						model: "user",
-						where: [{
-							field: "username",
-							value: normalizedUsername
-						}]
-					});
-					if (ctx.path === "/sign-up/email" && existingUser) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_IS_ALREADY_TAKEN);
-					if (ctx.path === "/update-user" && existingUser) {
-						const session = await getSessionFromCtx(ctx);
-						if (!session || existingUser.id !== session.user.id) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_IS_ALREADY_TAKEN);
+			{
+				matcher(context) {
+					return context.path === "/sign-up/email" || context.path === "/update-user";
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const username = ctx.body.username;
+					if (username !== void 0 && typeof username === "string") {
+						const validationError = await validateUsernameValue(username);
+						if (validationError) throw APIError.from("BAD_REQUEST", validationError);
+						const normalizedUsername = normalizer(username);
+						const existingUser = await ctx.context.adapter.findOne({
+							model: "user",
+							where: [{
+								field: "username",
+								value: normalizedUsername
+							}]
+						});
+						if (ctx.path === "/sign-up/email" && existingUser) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_IS_ALREADY_TAKEN);
+						if (ctx.path === "/update-user" && existingUser) {
+							const session = await getSessionFromCtx(ctx);
+							if (!session || existingUser.id !== session.user.id) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.USERNAME_IS_ALREADY_TAKEN);
+						}
 					}
-				}
-				const displayUsername = typeof ctx.body.displayUsername === "string" && options?.validationOrder?.displayUsername === "post-normalization" ? displayUsernameNormalizer(ctx.body.displayUsername) : ctx.body.displayUsername;
-				if (displayUsername !== void 0 && typeof displayUsername === "string") {
-					if (options?.displayUsernameValidator) {
-						if (!await options.displayUsernameValidator(displayUsername)) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.INVALID_DISPLAY_USERNAME);
+					const displayUsername = typeof ctx.body.displayUsername === "string" && options?.validationOrder?.displayUsername === "post-normalization" ? displayUsernameNormalizer(ctx.body.displayUsername) : ctx.body.displayUsername;
+					if (displayUsername !== void 0 && typeof displayUsername === "string") {
+						if (options?.displayUsernameValidator) {
+							if (!await options.displayUsernameValidator(displayUsername)) throw APIError.from("BAD_REQUEST", USERNAME_ERROR_CODES.INVALID_DISPLAY_USERNAME);
+						}
 					}
-				}
-			})
-		}, {
-			matcher(context) {
-				return context.path === "/sign-up/email";
+				})
 			},
-			handler: createAuthMiddleware(async (ctx) => {
-				if (ctx.body.username && !ctx.body.displayUsername) ctx.body.displayUsername = ctx.body.username;
-				if (ctx.body.displayUsername && !ctx.body.username) ctx.body.username = ctx.body.displayUsername;
-			})
-		}] },
+			{
+				matcher(context) {
+					return context.path === "/sign-up/email";
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					if (ctx.body.username && !ctx.body.displayUsername) ctx.body.displayUsername = ctx.body.username;
+				})
+			}
+		] },
 		options,
 		$ERROR_CODES: USERNAME_ERROR_CODES
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.6.20",
+  "version": "1.6.21",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -483,19 +483,19 @@
     "@better-fetch/fetch": "1.3.1",
     "@noble/ciphers": "^2.1.1",
     "@noble/hashes": "^2.0.1",
-    "better-call": "1.3.6",
+    "better-call": "1.3.7",
     "defu": "^6.1.4",
     "jose": "^6.1.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.1.1",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.6.20",
-    "@better-auth/drizzle-adapter": "1.6.20",
-    "@better-auth/kysely-adapter": "1.6.20",
-    "@better-auth/memory-adapter": "1.6.20",
-    "@better-auth/mongo-adapter": "1.6.20",
-    "@better-auth/prisma-adapter": "1.6.20",
-    "@better-auth/telemetry": "1.6.20"
+    "@better-auth/core": "1.6.21",
+    "@better-auth/drizzle-adapter": "1.6.21",
+    "@better-auth/kysely-adapter": "1.6.21",
+    "@better-auth/memory-adapter": "1.6.21",
+    "@better-auth/mongo-adapter": "1.6.21",
+    "@better-auth/prisma-adapter": "1.6.21",
+    "@better-auth/telemetry": "1.6.21"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.116.3",

package/dist/utils/get-request-ip.d.mts

@@ -1,6 +0,0 @@
-import { BetterAuthOptions } from "@better-auth/core";
-
-//#region src/utils/get-request-ip.d.ts
-declare function getIp(req: Request | Headers, options: BetterAuthOptions): string | null;
-//#endregion
-export { getIp };

package/dist/utils/get-request-ip.mjs

@@ -1,20 +0,0 @@
-import { isDevelopment, isTest } from "@better-auth/core/env";
-import { isValidIP, normalizeIP } from "@better-auth/core/utils/ip";
-//#region src/utils/get-request-ip.ts
-const LOCALHOST_IP = "127.0.0.1";
-function getIp(req, options) {
-	if (options.advanced?.ipAddress?.disableIpTracking) return null;
-	const headers = "headers" in req ? req.headers : req;
-	const ipHeaders = options.advanced?.ipAddress?.ipAddressHeaders || ["x-forwarded-for"];
-	for (const key of ipHeaders) {
-		const value = "get" in headers ? headers.get(key) : headers[key];
-		if (typeof value === "string") {
-			const ip = value.split(",")[0].trim();
-			if (isValidIP(ip)) return normalizeIP(ip, { ipv6Subnet: options.advanced?.ipAddress?.ipv6Subnet });
-		}
-	}
-	if (isTest() || isDevelopment()) return LOCALHOST_IP;
-	return null;
-}
-//#endregion
-export { getIp };