better-auth 1.6.20 → 1.6.22

package/dist/api/index.d.mts

@@ -1,6 +1,5 @@
 import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
-import { getIp } from "../utils/get-request-ip.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { DispatchContext, dispatchAuthEndpoint } from "./dispatch.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
@@ -11,7 +10,7 @@ import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEm
 import { error } from "./routes/error.mjs";
 import { ok } from "./routes/ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { signInEmail, signInSocial } from "./routes/sign-in.mjs";
 import { signOut } from "./routes/sign-out.mjs";
 import { signUpEmail } from "./routes/sign-up.mjs";
@@ -24,6 +23,7 @@ import * as _better_auth_core_db0 from "@better-auth/core/db";
 import { InternalLogger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import * as _better_auth_core_oauth20 from "@better-auth/core/oauth2";
+import { getIp } from "@better-auth/core/utils/ip";
 import * as better_call0 from "better-call";
 import { AuthEndpoint, AuthMiddleware, createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
 import * as zod from "zod";
@@ -3961,4 +3961,4 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
   } extends infer T_2 ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K] } : never) & T_1> : never : never : never;
 };
 //#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -1,11 +1,10 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
-import { getIp } from "../utils/get-request-ip.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
 import { getOAuthState } from "./state/oauth.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
@@ -21,6 +20,7 @@ import { dispatchAuthEndpoint } from "./dispatch.mjs";
 import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
 import { logger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
+import { getIp } from "@better-auth/core/utils/ip";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, withSpan } from "@better-auth/core/instrumentation";
 import { normalizePathname } from "@better-auth/core/utils/url";
 import { createRouter } from "better-call";
@@ -165,6 +165,8 @@ const router = (ctx, options) => {
 			const normalizedPath = normalizePathname(req.url, basePath);
 			if (disabledPaths.includes(normalizedPath)) return new Response("Not Found", { status: 404 });
 			let currentRequest = req;
+			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
+			if (rateLimitResponse) return rateLimitResponse;
 			for (const plugin of ctx.options.plugins || []) if (plugin.onRequest) {
 				const response = await withSpan(`onRequest ${plugin.id}`, {
 					[ATTR_HOOK_TYPE]: "onRequest",
@@ -173,8 +175,6 @@ const router = (ctx, options) => {
 				if (response && "response" in response) return response.response;
 				if (response && "request" in response) currentRequest = response.request;
 			}
-			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
-			if (rateLimitResponse) return rateLimitResponse;
 			return currentRequest;
 		},
 		async onResponse(res, req) {
@@ -213,4 +213,4 @@ const router = (ctx, options) => {
 	});
 };
 //#endregion
-export { APIError, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, accountInfo, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/rate-limiter/index.mjs

@@ -1,8 +1,7 @@
 import { wildcardMatch } from "../../utils/wildcard.mjs";
-import { getIp } from "../../utils/get-request-ip.mjs";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { createRateLimitKey, getIp } from "@better-auth/core/utils/ip";
 import { normalizePathname } from "@better-auth/core/utils/url";
-import { createRateLimitKey } from "@better-auth/core/utils/ip";
 //#region src/api/rate-limiter/index.ts
 const memory = /* @__PURE__ */ new Map();
 const MEMORY_STORE_MAX_ENTRIES = 1e5;
@@ -282,7 +281,7 @@ async function resolveRateLimitConfig(req, ctx) {
 	const ip = getIp(req, ctx.options);
 	if (!ip && ctx.options.advanced?.ipAddress?.disableIpTracking) return null;
 	if (!ip && !ipWarningLogged) {
-		ctx.logger.warn("Rate limiting could not determine a client IP and is falling back to a single shared per-path bucket. Ensure your runtime forwards a trusted client IP header and configure `advanced.ipAddress.ipAddressHeaders` if needed.");
+		ctx.logger.warn("Rate limiting could not determine a client IP and is falling back to a single shared per-path bucket. Ensure your runtime forwards a trusted client IP header, then set `advanced.ipAddress.ipAddressHeaders` or `advanced.ipAddress.trustedProxies` so the address can be resolved.");
 		ipWarningLogged = true;
 	}
 	const key = createRateLimitKey(ip ?? NO_TRUSTED_IP_KEY, path);

package/dist/api/routes/index.d.mts

@@ -4,7 +4,7 @@ import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEm
 import { error } from "./error.mjs";
 import { ok } from "./ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./password.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
 import { signInEmail, signInSocial } from "./sign-in.mjs";
 import { signOut } from "./sign-out.mjs";
 import { signUpEmail } from "./sign-up.mjs";

package/dist/api/routes/session.d.mts

@@ -63,6 +63,34 @@ declare const getSessionFromCtx: <U extends Record<string, any> = Record<string,
   session: S & Session$1;
   user: U & User$1;
 } | null>;
+/**
+ * Reads the session from the source that can authorize sensitive work.
+ *
+ * Stateful deployments must re-read the server-side session store because an
+ * earlier hook may have populated `ctx.context.session` from cookie cache.
+ * Stateless deployments keep the signed cookie as the session record.
+ */
+declare const getAuthoritativeSessionFromCtx: <U extends Record<string, any> = Record<string, any>, S extends Record<string, any> = Record<string, any>>(ctx: GenericEndpointContext) => Promise<{
+  session: S & {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null | undefined;
+    userAgent?: string | null | undefined;
+  };
+  user: U & {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null | undefined;
+  };
+} | null>;
 /**
  * The middleware forces the endpoint to require a valid session.
  */
@@ -90,9 +118,8 @@ declare const sessionMiddleware: (inputContext: better_call0.MiddlewareInputCont
   };
 }>;
 /**
- * This middleware forces the endpoint to require a valid session and ignores cookie cache.
+ * This middleware forces the endpoint to require a valid authoritative session.
  * This should be used for sensitive operations like password changes, account deletion, etc.
- * to ensure that revoked sessions cannot be used even if they're still cached in cookies.
  */
 declare const sensitiveSessionMiddleware: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
   session: {
@@ -420,4 +447,4 @@ declare const revokeOtherSessions: better_call0.StrictEndpoint<"/revoke-other-se
   status: boolean;
 }>;
 //#endregion
-export { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };
+export { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };

package/dist/api/routes/session.mjs

@@ -299,6 +299,18 @@ const getSessionFromCtx = async (ctx, config) => {
 	return session.response;
 };
 /**
+* Reads the session from the source that can authorize sensitive work.
+*
+* Stateful deployments must re-read the server-side session store because an
+* earlier hook may have populated `ctx.context.session` from cookie cache.
+* Stateless deployments keep the signed cookie as the session record.
+*/
+const getAuthoritativeSessionFromCtx = async (ctx) => {
+	if (!isStateful(ctx)) return getSessionFromCtx(ctx);
+	ctx.context.session = null;
+	return getSessionFromCtx(ctx, { disableCookieCache: true });
+};
+/**
 * The middleware forces the endpoint to require a valid session.
 */
 const sessionMiddleware = createAuthMiddleware(async (ctx) => {
@@ -310,12 +322,11 @@ const sessionMiddleware = createAuthMiddleware(async (ctx) => {
 	return { session };
 });
 /**
-* This middleware forces the endpoint to require a valid session and ignores cookie cache.
+* This middleware forces the endpoint to require a valid authoritative session.
 * This should be used for sensitive operations like password changes, account deletion, etc.
-* to ensure that revoked sessions cannot be used even if they're still cached in cookies.
 */
 const sensitiveSessionMiddleware = createAuthMiddleware(async (ctx) => {
-	const session = await getSessionFromCtx(ctx, { disableCookieCache: true });
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session?.session) throw APIError.from("UNAUTHORIZED", {
 		message: "Unauthorized",
 		code: "UNAUTHORIZED"
@@ -491,4 +502,4 @@ const revokeOtherSessions = createAuthEndpoint("/revoke-other-sessions", {
 	return ctx.json({ status: true });
 });
 //#endregion
-export { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };
+export { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };

package/dist/context/create-context.mjs

@@ -16,6 +16,7 @@ import { createLogger, env, isProduction, isTest } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { socialProviders } from "@better-auth/core/social-providers";
+import { findInvalidTrustedProxies } from "@better-auth/core/utils/ip";
 import { createTelemetry } from "@better-auth/telemetry";
 import defu$1 from "defu";
 //#region src/context/create-context.ts
@@ -86,6 +87,11 @@ Most of the features of Better Auth will not work correctly.`);
 		plugins: plugins.concat(internalPlugins)
 	};
 	checkEndpointConflicts(options, logger);
+	const trustedProxies = options.advanced?.ipAddress?.trustedProxies;
+	if (trustedProxies && trustedProxies.length > 0) {
+		const invalid = findInvalidTrustedProxies(trustedProxies);
+		if (invalid.length > 0) logger.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${invalid.join(", ")}. Each entry must be an IP address or CIDR range.`);
+	}
 	const cookies = getCookies(options);
 	const tables = getAuthTables(options);
 	const providers = (await Promise.all(Object.entries(options.socialProviders || {}).map(async ([key, originalConfig]) => {

package/dist/db/get-migration.mjs

@@ -148,6 +148,7 @@ async function getMigrations(config) {
 	const toBeCreated = [];
 	const toBeAdded = [];
 	for (const [key, value] of Object.entries(betterAuthSchema)) {
+		if (value.disableMigrations) continue;
 		const table = tableMetadata.find((t) => t.name === key);
 		if (!table) {
 			const tIndex = toBeCreated.findIndex((t) => t.table === key);

package/dist/db/get-schema.d.mts

@@ -5,6 +5,7 @@ import { DBFieldAttribute } from "@better-auth/core/db";
 declare function getSchema(config: BetterAuthOptions): Record<string, {
   fields: Record<string, DBFieldAttribute>;
   order: number;
+  disableMigrations?: boolean | undefined;
 }>;
 //#endregion
 export { getSchema };

package/dist/db/get-schema.mjs

@@ -23,11 +23,13 @@ function getSchema(config) {
 				...schema[table.modelName].fields,
 				...actualFields
 			};
+			if (table.disableMigrations) schema[table.modelName].disableMigrations = true;
 			continue;
 		}
 		schema[table.modelName] = {
 			fields: actualFields,
-			order: table.order || Infinity
+			order: table.order || Infinity,
+			disableMigrations: table.disableMigrations
 		};
 	}
 	return schema;

package/dist/db/index.d.mts

@@ -3,7 +3,8 @@ import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getSchema } from "./get-schema.mjs";
 import { DatabaseHooksEntry, getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
-import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
+import { revokeUnprovenAccountAccess } from "./revoke-unproven-account-access.mjs";
+import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
 import { FieldAttributeToSchema, toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
-export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, revokeUnprovenAccountAccess, toZodSchema };

package/dist/db/index.mjs

@@ -1,9 +1,10 @@
 import { __exportAll, __reExport } from "../_virtual/_rolldown/runtime.mjs";
 import { getSchema } from "./get-schema.mjs";
-import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
+import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
 import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
+import { revokeUnprovenAccountAccess } from "./revoke-unproven-account-access.mjs";
 import { toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
 //#region src/db/index.ts
@@ -19,14 +20,16 @@ var db_exports = /* @__PURE__ */ __exportAll({
 	parseAccountInput: () => parseAccountInput,
 	parseAccountOutput: () => parseAccountOutput,
 	parseAdditionalUserInput: () => parseAdditionalUserInput,
+	parseAdditionalUserInputFromProviderProfile: () => parseAdditionalUserInputFromProviderProfile,
 	parseInputData: () => parseInputData,
 	parseSessionInput: () => parseSessionInput,
 	parseSessionOutput: () => parseSessionOutput,
 	parseUserInput: () => parseUserInput,
 	parseUserOutput: () => parseUserOutput,
+	revokeUnprovenAccountAccess: () => revokeUnprovenAccountAccess,
 	toZodSchema: () => toZodSchema
 });
 import * as import__better_auth_core_db from "@better-auth/core/db";
 __reExport(db_exports, import__better_auth_core_db);
 //#endregion
-export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, revokeUnprovenAccountAccess, toZodSchema };

package/dist/db/internal-adapter.mjs

@@ -1,4 +1,3 @@
-import { getIp } from "../utils/get-request-ip.mjs";
 import { getSessionDefaultFields, parseSessionOutput, parseUserOutput } from "./schema.mjs";
 import { getDate } from "../utils/date.mjs";
 import { getStorageOption, processIdentifier } from "./verification-token-storage.mjs";
@@ -6,6 +5,7 @@ import { getWithHooks } from "./with-hooks.mjs";
 import { getCurrentAdapter, getCurrentAuthContext, runWithTransaction } from "@better-auth/core/context";
 import { generateId } from "@better-auth/core/utils/id";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { getIp } from "@better-auth/core/utils/ip";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 //#region src/db/internal-adapter.ts

package/dist/db/revoke-unproven-account-access.d.mts

@@ -0,0 +1,19 @@
+import { GenericEndpointContext } from "@better-auth/core";
+
+//#region src/db/revoke-unproven-account-access.d.ts
+/**
+ * Strip every credential and session a pre-existing account accrued before
+ * control of its email was proven.
+ *
+ * An `emailVerified: false` row carries no proof that the password on it belongs
+ * to the mailbox owner. When an email-primary proof (magic link, email OTP)
+ * resolves to such a row, deleting the `credential` account and revoking standing
+ * sessions makes the verified owner inherit no password or session that predates
+ * the proof. Call this before flipping `emailVerified` and minting the owner's
+ * session; it no-ops if a concurrent flow has already verified the account.
+ *
+ * @param userId - The pre-existing, not-yet-verified user being promoted.
+ */
+declare function revokeUnprovenAccountAccess(ctx: GenericEndpointContext, userId: string): Promise<void>;
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/db/revoke-unproven-account-access.mjs

@@ -0,0 +1,23 @@
+//#region src/db/revoke-unproven-account-access.ts
+/**
+* Strip every credential and session a pre-existing account accrued before
+* control of its email was proven.
+*
+* An `emailVerified: false` row carries no proof that the password on it belongs
+* to the mailbox owner. When an email-primary proof (magic link, email OTP)
+* resolves to such a row, deleting the `credential` account and revoking standing
+* sessions makes the verified owner inherit no password or session that predates
+* the proof. Call this before flipping `emailVerified` and minting the owner's
+* session; it no-ops if a concurrent flow has already verified the account.
+*
+* @param userId - The pre-existing, not-yet-verified user being promoted.
+*/
+async function revokeUnprovenAccountAccess(ctx, userId) {
+	const user = await ctx.context.internalAdapter.findUserById(userId);
+	if (!user || user.emailVerified) return;
+	const accounts = await ctx.context.internalAdapter.findAccounts(userId);
+	for (const account of accounts) if (account.providerId === "credential") await ctx.context.internalAdapter.deleteAccount(account.id);
+	await ctx.context.internalAdapter.deleteUserSessions(userId);
+}
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/db/schema.d.mts

@@ -24,6 +24,7 @@ declare function parseInputData<T extends Record<string, any>>(data: T, schema:
   action?: ("create" | "update") | undefined;
 }): Partial<T>;
 declare function parseUserInput(options: BetterAuthOptions, user: Record<string, any> | undefined, action: "create" | "update"): Partial<Record<string, any>>;
+declare function parseAdditionalUserInputFromProviderProfile(options: BetterAuthOptions, profile: Record<string, unknown> | undefined, action: "create" | "update"): Partial<Record<string, unknown>>;
 declare function parseAdditionalUserInput(options: BetterAuthOptions, user?: Record<string, any> | undefined): Partial<Record<string, any>>;
 declare function parseAccountInput(options: BetterAuthOptions, account: Partial<Account>): Partial<Partial<{
   id: string;
@@ -58,4 +59,4 @@ declare function mergeSchema<S extends BetterAuthPluginDBSchema>(schema: S, newS
   } | undefined;
 } | undefined } | undefined): S;
 //#endregion
-export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };
+export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/db/schema.mjs

@@ -113,6 +113,18 @@ function parseUserInput(options, user = {}, action) {
 		action
 	});
 }
+function parseAdditionalUserInputFromProviderProfile(options, profile = {}, action) {
+	const schema = getFields(options, "user", "input");
+	const allowedProfileFields = Object.create(null);
+	for (const key of Object.keys(profile)) {
+		if (schema[key]?.input === false) continue;
+		allowedProfileFields[key] = profile[key];
+	}
+	return parseInputData(allowedProfileFields, {
+		fields: schema,
+		action
+	});
+}
 function parseAdditionalUserInput(options, user) {
 	const schema = getFields(options, "user", "input");
 	return parseInputData(user || {}, { fields: schema });
@@ -146,4 +158,4 @@ function mergeSchema(schema, newSchema) {
 	return schema;
 }
 //#endregion
-export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };
+export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/oauth2/link-account.mjs

@@ -1,4 +1,5 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
+import { parseAdditionalUserInputFromProviderProfile } from "../db/schema.mjs";
 import { setAccountCookie } from "../cookies/session-store.mjs";
 import { redirectOnError } from "./errors.mjs";
 import { setTokenUtil } from "./utils.mjs";
@@ -64,9 +65,12 @@ async function handleOAuthUserInfo(c, opts) {
 			if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
 		}
 		if (overrideUserInfo) {
-			const { id: _, ...restUserInfo } = userInfo;
+			const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+			const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "update");
 			user = await c.context.internalAdapter.updateUser(dbUser.user.id, {
-				...restUserInfo,
+				name,
+				image,
+				...additionalUserFields,
 				email: userInfo.email.toLowerCase(),
 				emailVerified: userInfo.email.toLowerCase() === dbUser.user.email ? dbUser.user.emailVerified || userInfo.emailVerified : userInfo.emailVerified
 			});
@@ -78,7 +82,8 @@ async function handleOAuthUserInfo(c, opts) {
 			isRegister: false
 		};
 		try {
-			const { id: _, ...restUserInfo } = userInfo;
+			const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+			const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "create");
 			const accountData = {
 				accessToken: await setTokenUtil(account.accessToken, c.context),
 				refreshToken: await setTokenUtil(account.refreshToken, c.context),
@@ -90,8 +95,11 @@ async function handleOAuthUserInfo(c, opts) {
 				accountId: userInfo.id.toString()
 			};
 			const { user: createdUser, account: createdAccount } = await c.context.internalAdapter.createOAuthUser({
-				...restUserInfo,
-				email: userInfo.email.toLowerCase()
+				name,
+				image,
+				...additionalUserFields,
+				email: userInfo.email.toLowerCase(),
+				emailVerified: userInfo.emailVerified
 			}, accountData);
 			user = createdUser;
 			if (c.context.options.account?.storeAccountCookie) await setAccountCookie(c, createdAccount);
@@ -152,9 +160,14 @@ async function handleOAuthUserInfo(c, opts) {
 */
 async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
 	if (c.context.options.account?.accountLinking?.updateUserInfoOnLink !== true) return;
-	const { id: _id, email: _email, emailVerified: _emailVerified, ...profile } = userInfo;
 	try {
-		return await c.context.internalAdapter.updateUser(userId, profile);
+		const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+		const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "update");
+		return await c.context.internalAdapter.updateUser(userId, {
+			name,
+			image,
+			...additionalUserFields
+		});
 	} catch (e) {
 		c.context.logger.warn("Could not update user info on account link", e);
 		return;

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.20";
+var version = "1.6.22";
 //#endregion
 export { version };

package/dist/plugins/admin/routes.mjs

@@ -1,7 +1,7 @@
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermission } from "./has-permission.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -14,7 +14,7 @@ import * as z from "zod";
 * Will also provide additional types on the user to include role types.
 */
 const adminMiddleware = createAuthMiddleware(async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) throw APIError.fromStatus("UNAUTHORIZED");
 	return { session };
 });
@@ -146,7 +146,7 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 		$Infer: { body: {} }
 	}
 }, async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session && (ctx.request || ctx.headers)) throw ctx.error("UNAUTHORIZED");
 	if (session) {
 		if (!hasPermission({
@@ -885,7 +885,7 @@ const userHasPermission = (opts) => {
 		}
 	}, async (ctx) => {
 		if (!ctx.body?.permissions) throw new APIError("BAD_REQUEST", { message: "invalid permission check. no permission(s) were passed." });
-		const session = await getSessionFromCtx(ctx);
+		const session = await getAuthoritativeSessionFromCtx(ctx);
 		if (!session && (ctx.request || ctx.headers)) throw new APIError("UNAUTHORIZED");
 		if (!session && !ctx.body.userId && !ctx.body.role) throw new APIError("BAD_REQUEST", { message: "user id or role is required" });
 		const user = session?.user || (ctx.body.role ? {

package/dist/plugins/captcha/index.mjs

@@ -1,4 +1,3 @@
-import { getIp } from "../../utils/get-request-ip.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { middlewareResponse } from "../../utils/middleware-response.mjs";
 import { Providers, defaultEndpoints, siteVerifyMap } from "./constants.mjs";
@@ -7,6 +6,7 @@ import { captchaFox } from "./verify-handlers/captchafox.mjs";
 import { cloudflareTurnstile } from "./verify-handlers/cloudflare-turnstile.mjs";
 import { googleRecaptcha } from "./verify-handlers/google-recaptcha.mjs";
 import { hCaptcha } from "./verify-handlers/h-captcha.mjs";
+import { getIp } from "@better-auth/core/utils/ip";
 //#region src/plugins/captcha/index.ts
 const captcha = (options) => ({
 	id: "captcha",

package/dist/plugins/device-authorization/index.d.mts

@@ -21,7 +21,7 @@ declare const deviceAuthorizationOptionsSchema: z.ZodObject<{
   validateClient: z.ZodOptional<z.ZodCustom<(clientId: string) => boolean | Promise<boolean>, (clientId: string) => boolean | Promise<boolean>>>;
   onDeviceAuthRequest: z.ZodOptional<z.ZodCustom<(clientId: string, scope: string | undefined) => void | Promise<void>, (clientId: string, scope: string | undefined) => void | Promise<void>>>;
   verificationUri: z.ZodOptional<z.ZodString>;
-  schema: z.ZodCustom<{
+  schema: z.ZodOptional<z.ZodCustom<{
     deviceCode?: {
       modelName?: string | undefined;
       fields?: {
@@ -51,7 +51,7 @@ declare const deviceAuthorizationOptionsSchema: z.ZodObject<{
         scope?: string | undefined;
       } | undefined;
     } | undefined;
-  }>;
+  }>>;
 }, z.core.$strip>;
 type DeviceAuthorizationOptions = z.infer<typeof deviceAuthorizationOptionsSchema>;
 declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions>) => {
@@ -399,7 +399,12 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
     interval: TimeString;
     deviceCodeLength: number;
     userCodeLength: number;
-    schema: {
+    generateDeviceCode?: (() => string | Promise<string>) | undefined;
+    generateUserCode?: (() => string | Promise<string>) | undefined;
+    validateClient?: ((clientId: string) => boolean | Promise<boolean>) | undefined;
+    onDeviceAuthRequest?: ((clientId: string, scope: string | undefined) => void | Promise<void>) | undefined;
+    verificationUri?: string | undefined;
+    schema?: {
       deviceCode?: {
         modelName?: string | undefined;
         fields?: {
@@ -414,12 +419,7 @@ declare const deviceAuthorization: (options?: Partial<DeviceAuthorizationOptions
           scope?: string | undefined;
         } | undefined;
       } | undefined;
-    };
-    generateDeviceCode?: (() => string | Promise<string>) | undefined;
-    generateUserCode?: (() => string | Promise<string>) | undefined;
-    validateClient?: ((clientId: string) => boolean | Promise<boolean>) | undefined;
-    onDeviceAuthRequest?: ((clientId: string, scope: string | undefined) => void | Promise<void>) | undefined;
-    verificationUri?: string | undefined;
+    } | undefined;
   }>;
 };
 //#endregion

package/dist/plugins/device-authorization/index.mjs

@@ -25,7 +25,7 @@ const deviceAuthorizationOptionsSchema = z.object({
 	validateClient: z.custom((val) => typeof val === "function", { message: "validateClient must be a function that returns a boolean or a promise that resolves to a boolean." }).optional().describe("Function to validate the client ID. If not provided, no validation will be performed."),
 	onDeviceAuthRequest: z.custom((val) => typeof val === "function", { message: "onDeviceAuthRequest must be a function that returns void or a promise that resolves to void." }).optional().describe("Function to handle device authorization requests. If not provided, no additional actions will be taken."),
 	verificationUri: z.string().optional().describe("The URI where users verify their device code. Can be an absolute URL (https://example.com/device) or relative path (/custom-path). This will be returned as verification_uri in the device code response. If not provided, defaults to /device."),
-	schema: z.custom(() => true)
+	schema: z.custom(() => true).optional()
 });
 const deviceAuthorization = (options = {}) => {
 	const opts = deviceAuthorizationOptionsSchema.parse(options);

package/dist/plugins/email-otp/routes.mjs

@@ -3,6 +3,7 @@ import { getDate } from "../../utils/date.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
+import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
@@ -420,7 +421,10 @@ const signInEmailOTP = (opts) => createAuthEndpoint("/sign-in/email-otp", {
 			user: parseUserOutput(ctx.context.options, newUser)
 		});
 	}
-	if (!user.user.emailVerified) await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
+	if (!user.user.emailVerified) {
+		await revokeUnprovenAccountAccess(ctx, user.user.id);
+		await ctx.context.internalAdapter.updateUser(user.user.id, { emailVerified: true });
+	}
 	const session = await ctx.context.internalAdapter.createSession(user.user.id);
 	await setSessionCookie(ctx, {
 		session,

package/dist/plugins/magic-link/index.d.mts

@@ -22,9 +22,9 @@ interface MagicLinkOptions {
    * @deprecated Multi-attempt verification is no longer supported. Each
    * magic link token is consumed atomically on the first verification call,
    * so a given token mints at most one session regardless of this value
-   * (see GHSA-hc7v-rggr-4hvx). The option is kept for source compatibility
-   * and may be removed in a future major; any value other than `1` is
-   * ignored and emits a `console.warn` at plugin construction.
+   * The option is kept for source compatibility and may be removed in a future
+   * major; any value other than `1` is ignored and emits a `console.warn` at
+   * plugin construction.
    *
    * @default 1
    */