better-auth 1.6.30 → 1.6.32

package/dist/api/dispatch.mjs

@@ -4,7 +4,7 @@ import { runWithEndpointContext } from "@better-auth/core/context";
 import { shouldPublishLog } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import { createDefu } from "defu";
-import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, withSpan } from "@better-auth/core/instrumentation";
+import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_ROUTE, ATTR_OPERATION_ID, createWithSpan } from "@better-auth/core/instrumentation";
 import { kAPIErrorHeaderSymbol, toResponse } from "better-call";
 //#region src/api/dispatch.ts
 const defuReplaceArrays = createDefu((obj, key, value) => {
@@ -62,6 +62,7 @@ function mergeAPIErrorHeaders(error) {
 	return headers;
 }
 async function runBeforeHooks(context, hooks, endpoint, operationId) {
+	const withSpan = createWithSpan(context.context.options);
 	let modifiedContext = {};
 	for (const hook of hooks) {
 		let matched = false;
@@ -105,6 +106,7 @@ async function runBeforeHooks(context, hooks, endpoint, operationId) {
 	return { context: modifiedContext };
 }
 async function runAfterHooks(context, hooks, endpoint, operationId) {
+	const withSpan = createWithSpan(context.context.options);
 	for (const hook of hooks) {
 		if (!hook.matcher(context)) continue;
 		const hookSource = hooksSourceWeakMap.get(hook.handler) ?? "unknown";
@@ -182,6 +184,7 @@ function getHooks(authContext) {
 * @param input Input context whose `context` is an already-resolved `AuthContext`.
 */
 async function dispatchAuthEndpoint(endpoint, input) {
+	const withSpan = createWithSpan(input.context.options);
 	const operationId = input.operationId ?? getOperationId(endpoint);
 	const route = endpoint.path ?? "/:virtual";
 	const endpointMethod = endpoint.options?.method;

package/dist/api/index.mjs

@@ -21,7 +21,7 @@ import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
 import { logger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import { getIp } from "@better-auth/core/utils/ip";
-import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, withSpan } from "@better-auth/core/instrumentation";
+import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, createWithSpan } from "@better-auth/core/instrumentation";
 import { normalizePathname } from "@better-auth/core/utils/url";
 import { createRouter } from "better-call";
 import { createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
@@ -82,6 +82,7 @@ To resolve this, you can:
 	}
 }
 function getEndpoints(ctx, options) {
+	const withSpan = createWithSpan(options);
 	const pluginEndpoints = options.plugins?.reduce((acc, plugin) => {
 		return {
 			...acc,
@@ -148,6 +149,7 @@ function getEndpoints(ctx, options) {
 	};
 }
 const router = (ctx, options) => {
+	const withSpan = createWithSpan(options);
 	const { api, middlewares } = getEndpoints(ctx, options);
 	const basePath = new URL(ctx.baseURL).pathname;
 	return createRouter(api, {

package/dist/db/with-hooks.mjs

@@ -1,7 +1,8 @@
 import { getCurrentAdapter, getCurrentAuthContext, queueAfterTransactionHook } from "@better-auth/core/context";
-import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_HOOK_TYPE, withSpan } from "@better-auth/core/instrumentation";
+import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_HOOK_TYPE, createWithSpan } from "@better-auth/core/instrumentation";
 //#region src/db/with-hooks.ts
 function getWithHooks(adapter, ctx) {
+	const withSpan = createWithSpan(ctx.options);
 	const hooksEntries = ctx.hooks;
 	async function createWithHooks(data, model, customCreateFn) {
 		const context = await getCurrentAuthContext().catch(() => null);

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.6.30";
+var version = "1.6.32";
 //#endregion
 export { version };

package/dist/plugins/captcha/index.mjs

@@ -44,6 +44,7 @@ const captcha = (options) => ({
 			};
 			if (options.provider === Providers.CLOUDFLARE_TURNSTILE) return await cloudflareTurnstile({
 				...handlerParams,
+				logger: ctx.logger,
 				expectedAction: options.expectedAction,
 				allowedHostnames: options.allowedHostnames
 			});

package/dist/plugins/captcha/verify-handlers/cloudflare-turnstile.mjs

@@ -3,7 +3,7 @@ import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
 import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/captcha/verify-handlers/cloudflare-turnstile.ts
-const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey, remoteIP, expectedAction, allowedHostnames }) => {
+const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey, logger, remoteIP, expectedAction, allowedHostnames }) => {
 	const response = await betterFetch(siteVerifyURL, {
 		method: "POST",
 		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
@@ -15,14 +15,33 @@ const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey,
 		})
 	});
 	if (!response.data || response.error) throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message);
-	const verificationFailed = () => middlewareResponse({
-		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
-		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
-		status: 403
+	const verificationFailed = (details) => {
+		logger.warn("Cloudflare Turnstile verification failed", {
+			provider: "cloudflare-turnstile",
+			...details
+		});
+		return middlewareResponse({
+			message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+			code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+			status: 403
+		});
+	};
+	if (!response.data.success) return verificationFailed({
+		reason: "siteverify_rejected",
+		errorCodes: response.data["error-codes"] ?? [],
+		...response.data.hostname && { hostname: response.data.hostname },
+		...response.data.action && { action: response.data.action }
+	});
+	if (expectedAction && response.data.action !== expectedAction) return verificationFailed({
+		reason: "action_mismatch",
+		expectedAction,
+		actualAction: response.data.action
+	});
+	if (allowedHostnames && allowedHostnames.length > 0 && !(response.data.hostname && allowedHostnames.includes(response.data.hostname))) return verificationFailed({
+		reason: "hostname_mismatch",
+		allowedHostnames,
+		actualHostname: response.data.hostname
 	});
-	if (!response.data.success) return verificationFailed();
-	if (expectedAction && response.data.action !== expectedAction) return verificationFailed();
-	if (allowedHostnames && allowedHostnames.length > 0 && !(response.data.hostname && allowedHostnames.includes(response.data.hostname))) return verificationFailed();
 };
 //#endregion
 export { cloudflareTurnstile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.6.30",
+  "version": "1.6.32",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -489,13 +489,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.1.1",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.6.30",
-    "@better-auth/drizzle-adapter": "1.6.30",
-    "@better-auth/kysely-adapter": "1.6.30",
-    "@better-auth/memory-adapter": "1.6.30",
-    "@better-auth/mongo-adapter": "1.6.30",
-    "@better-auth/prisma-adapter": "1.6.30",
-    "@better-auth/telemetry": "1.6.30"
+    "@better-auth/core": "1.6.32",
+    "@better-auth/drizzle-adapter": "1.6.32",
+    "@better-auth/kysely-adapter": "1.6.32",
+    "@better-auth/memory-adapter": "1.6.32",
+    "@better-auth/mongo-adapter": "1.6.32",
+    "@better-auth/prisma-adapter": "1.6.32",
+    "@better-auth/telemetry": "1.6.32"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.116.3",