better-auth 1.6.25 → 1.6.26

package/dist/api/rate-limiter/index.mjs

@@ -125,7 +125,7 @@ function createDatabaseStorageWrapper(ctx) {
 					lastRequest: now
 				}
 			})) {
-				deleteExpiredRows(now);
+				await deleteExpiredRows(now);
 				return {
 					allowed: true,
 					retryAfter: null
@@ -166,9 +166,9 @@ function createDatabaseStorageWrapper(ctx) {
 			retryAfter: getRetryAfter(fresh.lastRequest, rule.window)
 		};
 	};
-	const deleteExpiredRows = (now) => {
+	const deleteExpiredRows = async (now) => {
 		const cutoff = now - Math.max(ctx.rateLimit.window, ...getDefaultSpecialRules().map((r) => r.window)) * 1e3;
-		ctx.runInBackground(db.deleteMany({
+		await ctx.runInBackgroundOrAwait(db.deleteMany({
 			model,
 			where: [{
 				field: "lastRequest",

package/dist/db/internal-adapter.mjs

@@ -17,6 +17,8 @@ const createInternalAdapter = (adapter, ctx) => {
 	const logger = ctx.logger;
 	const options = ctx.options;
 	const secondaryStorage = options.secondaryStorage;
+	const databaseStoresSessions = !secondaryStorage || options.session?.storeSessionInDatabase === true;
+	const preservesDatabaseSessions = secondaryStorage !== void 0 && options.session?.preserveSessionInDatabase === true;
 	const verificationConsumeLocks = /* @__PURE__ */ new Map();
 	let warnedNonAtomicConsume = false;
 	const sessionExpiration = options.session?.expiresIn || 3600 * 24 * 7;
@@ -55,6 +57,20 @@ const createInternalAdapter = (adapter, ctx) => {
 			if (verificationConsumeLocks.get(key) === next) verificationConsumeLocks.delete(key);
 		}
 	}
+	const deleteSecondaryStorageSessions = async (userId) => {
+		if (!secondaryStorage) return;
+		const activeSession = await secondaryStorage.get(`active-sessions-${userId}`);
+		const sessions = activeSession ? safeJSONParse(activeSession) : [];
+		if (!sessions) return;
+		for (const session of sessions) await secondaryStorage.delete(session.token);
+		await secondaryStorage.delete(`active-sessions-${userId}`);
+	};
+	const deleteDatabaseSessions = async (userId) => {
+		await deleteManyWithHooks([{
+			field: "userId",
+			value: userId
+		}], "session", void 0);
+	};
 	return {
 		createOAuthUser: async (user, account) => {
 			return runWithTransaction(adapter, async () => {
@@ -146,10 +162,8 @@ const createInternalAdapter = (adapter, ctx) => {
 			return total;
 		},
 		deleteUser: async (userId) => {
-			if (!secondaryStorage || options.session?.storeSessionInDatabase) await deleteManyWithHooks([{
-				field: "userId",
-				value: userId
-			}], "session", void 0);
+			await deleteSecondaryStorageSessions(userId);
+			if (databaseStoresSessions) await deleteDatabaseSessions(userId);
 			await deleteManyWithHooks([{
 				field: "userId",
 				value: userId
@@ -271,7 +285,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					const sessionStringified = await secondaryStorage.get(sessionToken);
 					if (sessionStringified) try {
 						const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
-						if (!s) return [];
+						if (!s) continue;
 						const expiresAt = new Date(s.session.expiresAt);
 						if (options?.onlyActiveSessions && expiresAt <= /* @__PURE__ */ new Date()) continue;
 						const session = {
@@ -377,9 +391,8 @@ const createInternalAdapter = (adapter, ctx) => {
 					} else logger.error("Active sessions list not found in secondary storage");
 				}
 				await secondaryStorage.delete(token);
-				if (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase) return;
 			}
-			await deleteWithHooks([{
+			if (databaseStoresSessions && !preservesDatabaseSessions) await deleteWithHooks([{
 				field: "token",
 				value: token
 			}], "session", void 0);
@@ -402,25 +415,14 @@ const createInternalAdapter = (adapter, ctx) => {
 			}], "account", void 0);
 		},
 		deleteUserSessions: async (userId) => {
-			if (secondaryStorage) {
-				const activeSession = await secondaryStorage.get(`active-sessions-${userId}`);
-				const sessions = activeSession ? safeJSONParse(activeSession) : [];
-				if (!sessions) return;
-				for (const session of sessions) await secondaryStorage.delete(session.token);
-				await secondaryStorage.delete(`active-sessions-${userId}`);
-				if (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase) return;
-			}
-			await deleteManyWithHooks([{
-				field: "userId",
-				value: userId
-			}], "session", void 0);
+			await deleteSecondaryStorageSessions(userId);
+			if (databaseStoresSessions && !preservesDatabaseSessions) await deleteDatabaseSessions(userId);
 		},
 		deleteSessions: async (sessionTokens) => {
 			if (secondaryStorage) {
 				for (const sessionToken of sessionTokens) if (await secondaryStorage.get(sessionToken)) await secondaryStorage.delete(sessionToken);
-				if (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase) return;
 			}
-			await deleteManyWithHooks([{
+			if (databaseStoresSessions && !preservesDatabaseSessions) await deleteManyWithHooks([{
 				field: "token",
 				value: sessionTokens,
 				operator: "in"

package/dist/integrations/next-js.mjs

@@ -16,6 +16,20 @@ function toNextJsHandler(auth) {
 		DELETE: handler
 	};
 }
+let nextHeadersModulePromise;
+/**
+* Cache ESM resolution while leaving the request-scoped `headers()` and
+* `cookies()` calls uncached.
+*
+* @see https://github.com/better-auth/better-auth/issues/10466
+*/
+const loadNextHeadersModule = () => {
+	nextHeadersModulePromise ??= import("next/headers.js").catch((error) => {
+		nextHeadersModulePromise = void 0;
+		throw error;
+	});
+	return nextHeadersModulePromise;
+};
 const nextCookies = () => {
 	let hasWarned = false;
 	return {
@@ -34,7 +48,7 @@ const nextCookies = () => {
 					if ("_flag" in ctx && ctx._flag === "router") return;
 					let headersStore;
 					try {
-						const { headers } = await import("next/headers.js");
+						const { headers } = await loadNextHeadersModule();
 						headersStore = await headers();
 					} catch {
 						return;
@@ -68,7 +82,7 @@ const nextCookies = () => {
 						const parsed = parseSetCookieHeader(setCookies);
 						let cookieHelper;
 						try {
-							const { cookies } = await import("next/headers.js");
+							const { cookies } = await loadNextHeadersModule();
 							cookieHelper = await cookies();
 						} catch (error) {
 							if (error instanceof Error && (error.message.startsWith("`cookies` was called outside a request scope.") || error.message.includes("Cannot find module"))) return;

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.25";
+var version = "1.6.26";
 //#endregion
 export { version };

package/dist/plugins/anonymous/index.mjs

@@ -154,7 +154,6 @@ const anonymous = (options) => {
 				const newSessionIsAnonymous = Boolean(newSessionUser?.isAnonymous);
 				if (options?.disableDeleteAnonymousUser || isSameUser || newSessionIsAnonymous) return;
 				try {
-					await ctx.context.internalAdapter.deleteUserSessions(session.user.id);
 					await ctx.context.internalAdapter.deleteUser(session.user.id);
 				} catch (error) {
 					ctx.context.logger.error("Failed to clean up anonymous user during post-link cleanup", {

package/dist/plugins/email-otp/index.mjs

@@ -56,7 +56,7 @@ const emailOTP = (options) => {
 				if (email) {
 					const otp = opts.generateOTP({
 						email,
-						type: ctx.body.type
+						type: "email-verification"
 					}, ctx) || defaultOTPGenerator(opts);
 					const storedOTP = await storeOTP(ctx, opts, otp);
 					await ctx.context.internalAdapter.createVerificationValue({

package/dist/plugins/email-otp/routes.mjs

@@ -235,7 +235,6 @@ const checkVerificationOTP = (opts) => createAuthEndpoint("/email-otp/check-veri
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
 	if (!z.email().safeParse(email).success) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
-	if (!await ctx.context.internalAdapter.findUserByEmail(email)) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const identifier = toOTPIdentifier(ctx.body.type, email);
 	const verificationValue = await ctx.context.internalAdapter.findVerificationValue(identifier);
 	if (!verificationValue) throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
@@ -253,6 +252,12 @@ const checkVerificationOTP = (opts) => createAuthEndpoint("/email-otp/check-veri
 		await ctx.context.internalAdapter.updateVerificationByIdentifier(identifier, { value: `${otpValue}:${parseInt(attempts || "0") + 1}` });
 		throw APIError$1.from("BAD_REQUEST", EMAIL_OTP_ERROR_CODES.INVALID_OTP);
 	}
+	if (!await ctx.context.internalAdapter.findUserByEmail(email))
+ /**
+	* safe to leak the existence of a user, given the user has already the OTP from the
+	* email
+	*/
+	throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
 	return ctx.json({ success: true });
 });
 const verifyEmailOTPBodySchema = z.object({
@@ -574,13 +579,13 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	} }
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
-	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("forget-password", email), ctx.body.otp);
-	const user = await ctx.context.internalAdapter.findUserByEmail(email, { includeAccounts: true });
-	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const minPasswordLength = ctx.context.password.config.minPasswordLength;
 	if (ctx.body.password.length < minPasswordLength) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
 	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
 	if (ctx.body.password.length > maxPasswordLength) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("forget-password", email), ctx.body.otp);
+	const user = await ctx.context.internalAdapter.findUserByEmail(email, { includeAccounts: true });
+	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const passwordHash = await ctx.context.password.hash(ctx.body.password);
 	if (!user.accounts?.find((account) => account.providerId === "credential")) await ctx.context.internalAdapter.createAccount({
 		userId: user.user.id,

package/dist/plugins/jwt/adapter.mjs

@@ -1,17 +1,18 @@
+import { getCurrentAdapter } from "@better-auth/core/context";
 //#region src/plugins/jwt/adapter.ts
-const getJwksAdapter = (adapter, options) => {
+const getJwksAdapter = (baseAdapter, options) => {
 	return {
 		getAllKeys: async (ctx) => {
 			if (options?.adapter?.getJwks) return await options.adapter.getJwks(ctx);
-			return await adapter.findMany({ model: "jwks" });
+			return await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" });
 		},
 		getLatestKey: async (ctx) => {
 			if (options?.adapter?.getJwks) return (await options.adapter.getJwks(ctx))?.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
-			return (await adapter.findMany({ model: "jwks" }))?.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
+			return (await (await getCurrentAdapter(baseAdapter)).findMany({ model: "jwks" }))?.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
 		},
 		createJwk: async (ctx, webKey) => {
 			if (options?.adapter?.createJwk) return await options.adapter.createJwk(webKey, ctx);
-			return await adapter.create({
+			return await (await getCurrentAdapter(baseAdapter)).create({
 				model: "jwks",
 				data: {
 					...webKey,

package/dist/plugins/jwt/client.d.mts

@@ -1,6 +1,8 @@
 import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions } from "./types.mjs";
 import { jwt } from "./index.mjs";
+import { BetterAuthClientOptions, ClientFetchOption, ClientStore } from "@better-auth/core";
 import { JSONWebKeySet } from "jose";
+import { BetterFetch } from "@better-fetch/fetch";
 //#region src/plugins/jwt/client.d.ts
 interface JwtClientOptions {
   jwks?: {
@@ -20,8 +22,8 @@ declare const jwtClient: (options?: JwtClientOptions) => {
   pathMethods: {
     [x: string]: "GET";
   };
-  getActions: ($fetch: import("@better-fetch/fetch").BetterFetch) => {
-    jwks: (fetchOptions?: any) => Promise<{
+  getActions: ($fetch: BetterFetch, _$store: ClientStore, _options: BetterAuthClientOptions | undefined) => {
+    jwks: (fetchOptions?: ClientFetchOption) => Promise<{
       data: null;
       error: {
         message?: string | undefined;

package/dist/plugins/jwt/client.mjs

@@ -7,7 +7,7 @@ const jwtClient = (options) => {
 		version: PACKAGE_VERSION,
 		$InferServerPlugin: {},
 		pathMethods: { [jwksPath]: "GET" },
-		getActions: ($fetch) => ({ jwks: async (fetchOptions) => {
+		getActions: ($fetch, _$store, _options) => ({ jwks: async (fetchOptions) => {
 			return await $fetch(jwksPath, {
 				method: "GET",
 				...fetchOptions

package/dist/plugins/oauth-proxy/index.mjs

@@ -10,6 +10,7 @@ import { parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
+import { safeJSONParse } from "@better-auth/core/utils/json";
 import { defu as defu$1 } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
@@ -29,7 +30,8 @@ const oauthProxyQuerySchema = z.object({
 });
 const oauthCallbackQuerySchema = z.object({
 	code: z.string().optional(),
-	error: z.string().optional()
+	error: z.string().optional(),
+	user: z.string().optional()
 });
 const oAuthProxy = (opts) => {
 	const maxAge = opts?.maxAge ?? 60;
@@ -170,7 +172,7 @@ const oAuthProxy = (opts) => {
 						ctx.context.logger.warn("Invalid OAuth callback query", query.error);
 						return;
 					}
-					const { code, error } = query.data;
+					const { code, error, user: userData } = query.data;
 					let stateData;
 					try {
 						stateData = parseJSON(await symmetricDecrypt({
@@ -209,7 +211,15 @@ const oAuthProxy = (opts) => {
 						throw redirectOnError(ctx, errorURL, "invalid_code");
 					}
 					if (!tokens) throw redirectOnError(ctx, errorURL, "invalid_code");
-					const userInfo = (await provider.getUserInfo(tokens))?.user;
+					const parsedUserData = userData ? safeJSONParse(userData) : null;
+					const userInfo = (await provider.getUserInfo({
+						...tokens,
+						/**
+						* The user object from the provider
+						* This is only available for some providers like Apple
+						*/
+						user: parsedUserData ?? void 0
+					}))?.user;
 					if (!userInfo) {
 						ctx.context.logger.error("Unable to get user info from provider");
 						throw redirectOnError(ctx, errorURL, "unable_to_get_user_info");

package/dist/plugins/one-tap/client.d.mts

@@ -1,4 +1,5 @@
-import { ClientFetchOption } from "@better-auth/core";
+import { BetterAuthClientOptions, ClientFetchOption, ClientStore } from "@better-auth/core";
+import { BetterFetch } from "@better-fetch/fetch";
 //#region src/plugins/one-tap/client.d.ts
 declare global {
   interface Window {
@@ -162,10 +163,10 @@ declare const oneTapClient: (options: GoogleOneTapOptions) => {
       onResponse(ctx: import("@better-fetch/fetch").ResponseContext): Promise<void>;
     };
   }[];
-  getActions: ($fetch: import("@better-fetch/fetch").BetterFetch, _: import("@better-auth/core").ClientStore) => {
+  getActions: ($fetch: BetterFetch, _$store: ClientStore, _options: BetterAuthClientOptions | undefined) => {
     oneTap: (opts?: GoogleOneTapActionOptions | undefined, fetchOptions?: ClientFetchOption | undefined) => Promise<void>;
   };
-  getAtoms($fetch: import("@better-fetch/fetch").BetterFetch): {};
+  getAtoms($fetch: BetterFetch): {};
 };
 //#endregion
 export { GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, oneTapClient };

package/dist/plugins/one-tap/client.mjs

@@ -26,7 +26,7 @@ const oneTapClient = (options) => {
 				navigator.credentials.preventSilentAccess();
 			} }
 		}],
-		getActions: ($fetch, _) => {
+		getActions: ($fetch, _$store, _options) => {
 			return { oneTap: async (opts, fetchOptions) => {
 				if (isRequestInProgress) {
 					console.warn("A Google One Tap request is already in progress. Please wait.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.6.25",
+  "version": "1.6.26",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -489,17 +489,17 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.1.1",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.6.25",
-    "@better-auth/drizzle-adapter": "1.6.25",
-    "@better-auth/kysely-adapter": "1.6.25",
-    "@better-auth/memory-adapter": "1.6.25",
-    "@better-auth/mongo-adapter": "1.6.25",
-    "@better-auth/prisma-adapter": "1.6.25",
-    "@better-auth/telemetry": "1.6.25"
+    "@better-auth/core": "1.6.26",
+    "@better-auth/drizzle-adapter": "1.6.26",
+    "@better-auth/kysely-adapter": "1.6.26",
+    "@better-auth/memory-adapter": "1.6.26",
+    "@better-auth/mongo-adapter": "1.6.26",
+    "@better-auth/prisma-adapter": "1.6.26",
+    "@better-auth/telemetry": "1.6.26"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.116.3",
-    "@sveltejs/kit": "^2.60.1",
+    "@sveltejs/kit": "^2.70.1",
     "@tanstack/react-start": "^1.168.4",
     "@tanstack/solid-start": "^1.168.4",
     "@types/bun": "^1.3.9",
@@ -507,8 +507,8 @@
     "@types/pg": "^8.16.0",
     "@types/react": "^19.2.14",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/sdk-trace-base": "^1.30.0",
-    "@opentelemetry/sdk-trace-node": "^1.30.0",
+    "@opentelemetry/sdk-trace-base": "^2.10.0",
+    "@opentelemetry/sdk-trace-node": "^2.10.0",
     "happy-dom": "^20.8.9",
     "listhen": "^1.9.0",
     "msw": "^2.12.10",
@@ -520,8 +520,8 @@
     "tsdown": "0.22.7",
     "type-fest": "^5.4.4",
     "typescript": "^6.0.3",
-    "vite": "^7.3.2",
-    "vitest": "^4.1.5",
+    "vite": "^8.1.5",
+    "vitest": "^4.1.10",
     "vue": "^3.5.29"
   },
   "peerDependencies": {