better-auth 1.7.0-beta.2 → 1.7.0-beta.4

package/dist/node_modules/.pnpm/which@2.0.2/node_modules/which/which.mjs

@@ -0,0 +1,76 @@
+import { __commonJSMin, __require } from "../../../../../_virtual/_rolldown/runtime.mjs";
+import { require_isexe } from "../../../isexe@2.0.0/node_modules/isexe/index.mjs";
+//#region ../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js
+var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	const isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
+	const path = __require("path");
+	const COLON = isWindows ? ";" : ":";
+	const isexe = require_isexe();
+	const getNotFoundError = (cmd) => Object.assign(/* @__PURE__ */ new Error(`not found: ${cmd}`), { code: "ENOENT" });
+	const getPathInfo = (cmd, opt) => {
+		const colon = opt.colon || COLON;
+		const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? [""] : [...isWindows ? [process.cwd()] : [], ...(opt.path || process.env.PATH || "").split(colon)];
+		const pathExtExe = isWindows ? opt.pathExt || process.env.PATHEXT || ".EXE;.CMD;.BAT;.COM" : "";
+		const pathExt = isWindows ? pathExtExe.split(colon) : [""];
+		if (isWindows) {
+			if (cmd.indexOf(".") !== -1 && pathExt[0] !== "") pathExt.unshift("");
+		}
+		return {
+			pathEnv,
+			pathExt,
+			pathExtExe
+		};
+	};
+	const which = (cmd, opt, cb) => {
+		if (typeof opt === "function") {
+			cb = opt;
+			opt = {};
+		}
+		if (!opt) opt = {};
+		const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+		const found = [];
+		const step = (i) => new Promise((resolve, reject) => {
+			if (i === pathEnv.length) return opt.all && found.length ? resolve(found) : reject(getNotFoundError(cmd));
+			const ppRaw = pathEnv[i];
+			const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+			const pCmd = path.join(pathPart, cmd);
+			resolve(subStep(!pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd, i, 0));
+		});
+		const subStep = (p, i, ii) => new Promise((resolve, reject) => {
+			if (ii === pathExt.length) return resolve(step(i + 1));
+			const ext = pathExt[ii];
+			isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
+				if (!er && is) if (opt.all) found.push(p + ext);
+				else return resolve(p + ext);
+				return resolve(subStep(p, i, ii + 1));
+			});
+		});
+		return cb ? step(0).then((res) => cb(null, res), cb) : step(0);
+	};
+	const whichSync = (cmd, opt) => {
+		opt = opt || {};
+		const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt);
+		const found = [];
+		for (let i = 0; i < pathEnv.length; i++) {
+			const ppRaw = pathEnv[i];
+			const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
+			const pCmd = path.join(pathPart, cmd);
+			const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
+			for (let j = 0; j < pathExt.length; j++) {
+				const cur = p + pathExt[j];
+				try {
+					if (isexe.sync(cur, { pathExt: pathExtExe })) if (opt.all) found.push(cur);
+					else return cur;
+				} catch (ex) {}
+			}
+		}
+		if (opt.all && found.length) return found;
+		if (opt.nothrow) return null;
+		throw getNotFoundError(cmd);
+	};
+	module.exports = which;
+	which.sync = whichSync;
+}));
+//#endregion
+export default require_which();
+export { require_which };

package/dist/oauth2/errors.mjs

@@ -0,0 +1,27 @@
+//#region src/oauth2/errors.ts
+const HANDLING_DOCS_URL = "https://www.better-auth.com/docs/concepts/oauth#handling-providers-without-email";
+/**
+* Redirect the user to the OAuth error page with a machine-readable `error`
+* code (and optional `error_description`).
+*
+* Every OAuth callback path routes its failures through this helper so the
+* query parameter name, the `?`/`&` separator, and URL encoding are decided in
+* one place. The error page reads the `error` query parameter, so callers must
+* never hand-build the redirect with a different parameter name.
+*/
+function redirectOnError(ctx, errorURL, error, description) {
+	const params = new URLSearchParams({ error });
+	if (description) params.set("error_description", description);
+	const sep = errorURL.includes("?") ? "&" : "?";
+	throw ctx.redirect(`${errorURL}${sep}${params.toString()}`);
+}
+/**
+* Build the logger message shown when an OAuth provider does not return an
+* email address. Kept in one place so every rejection site points users at
+* the same workaround docs.
+*/
+function missingEmailLogMessage(providerId, options) {
+	return `${options?.source === "generic" ? `Generic OAuth provider "${providerId}"` : `Provider "${providerId}"`} did not return an email${options?.source === "id_token" ? " in the id token" : ""}. Either request the provider's email scope, or synthesize one via \`mapProfileToUser\`. See ${HANDLING_DOCS_URL}`;
+}
+//#endregion
+export { missingEmailLogMessage, redirectOnError };

package/dist/oauth2/index.d.mts

@@ -1,5 +1,5 @@
 import { generateState, parseState } from "./state.mjs";
-import { handleOAuthUserInfo } from "./link-account.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
 import { decryptOAuthToken, setTokenUtil } from "./utils.mjs";
 export * from "@better-auth/core/oauth2";
-export { decryptOAuthToken, generateState, handleOAuthUserInfo, parseState, setTokenUtil };
+export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateState, handleOAuthUserInfo, parseState, setTokenUtil };

package/dist/oauth2/index.mjs

@@ -1,5 +1,5 @@
-import { generateState, parseState } from "./state.mjs";
 import { decryptOAuthToken, setTokenUtil } from "./utils.mjs";
-import { handleOAuthUserInfo } from "./link-account.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { generateState, parseState } from "./state.mjs";
 export * from "@better-auth/core/oauth2";
-export { decryptOAuthToken, generateState, handleOAuthUserInfo, parseState, setTokenUtil };
+export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateState, handleOAuthUserInfo, parseState, setTokenUtil };

package/dist/oauth2/link-account.d.mts

@@ -42,5 +42,31 @@ declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
   error: null;
   isRegister: boolean;
 }>;
+/**
+ * Provider profile a freshly linked account may copy onto the local user.
+ * `id` is the provider's account id (never the local user id), and `email`/
+ * `emailVerified` are identity anchors; all three are stripped before the
+ * remaining fields are written.
+ */
+type LinkedProviderProfile = {
+  id: string | number;
+  name?: string | undefined;
+  email?: string | null | undefined;
+  emailVerified?: boolean | undefined;
+  image?: string | null | undefined;
+};
+/**
+ * Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
+ * copy the freshly linked provider's profile onto the local user, matching the
+ * field set persisted on sign-up. The local `email` and `emailVerified` are
+ * never changed, so a link can't rebind the account's identity, and
+ * `updateUser` drops `undefined` fields, so a provider that omits one leaves
+ * the existing column intact.
+ *
+ * Returns the updated user so a caller that issues a session can seed the
+ * cookie cache with the fresh row. Returns `undefined` when the policy is
+ * disabled or the update fails: a failed profile sync must not abort the link.
+ */
+declare function applyUpdateUserInfoOnLink(c: GenericEndpointContext, userId: string, userInfo: LinkedProviderProfile): Promise<User | undefined>;
 //#endregion
-export { handleOAuthUserInfo };
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };

package/dist/oauth2/link-account.mjs

@@ -1,5 +1,6 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { setAccountCookie } from "../cookies/session-store.mjs";
+import { redirectOnError } from "./errors.mjs";
 import { setTokenUtil } from "./utils.mjs";
 import { createEmailVerificationToken } from "../api/routes/email-verification.mjs";
 import { isDevelopment, logger } from "@better-auth/core/env";
@@ -8,8 +9,7 @@ async function handleOAuthUserInfo(c, opts) {
 	const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
 	const dbUser = await c.context.internalAdapter.findOAuthUser(userInfo.email.toLowerCase(), account.accountId, account.providerId).catch((e) => {
 		logger.error("Better auth was unable to query your database.\nError: ", e);
-		const errorURL = c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`;
-		throw c.redirect(`${errorURL}?error=internal_server_error`);
+		redirectOnError(c, c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`, "internal_server_error");
 	});
 	let user = dbUser?.user;
 	const isRegister = !user;
@@ -17,7 +17,9 @@ async function handleOAuthUserInfo(c, opts) {
 		const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.providerId === account.providerId && acc.accountId === account.accountId);
 		if (!linkedAccount) {
 			const accountLinking = c.context.options.account?.accountLinking;
-			if (!(opts.isTrustedProvider || c.context.trustedProviders.includes(account.providerId)) && !userInfo.emailVerified || accountLinking?.enabled === false || accountLinking?.disableImplicitLinking === true) {
+			const isTrustedProvider = opts.isTrustedProvider || c.context.trustedProviders.includes(account.providerId);
+			const requireLocalEmailVerified = accountLinking?.requireLocalEmailVerified ?? true;
+			if (!isTrustedProvider && !userInfo.emailVerified || requireLocalEmailVerified && !dbUser.user.emailVerified || accountLinking?.enabled === false || accountLinking?.disableImplicitLinking === true) {
 				if (isDevelopment()) logger.warn(`User already exist but account isn't linked to ${account.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`);
 				return {
 					error: "account not linked",
@@ -44,6 +46,7 @@ async function handleOAuthUserInfo(c, opts) {
 				};
 			}
 			if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
+			user = await applyUpdateUserInfoOnLink(c, dbUser.user.id, userInfo) ?? user;
 		} else {
 			const freshTokens = c.context.options.account?.updateAccountOnSignIn !== false ? Object.fromEntries(Object.entries({
 				idToken: account.idToken,
@@ -94,7 +97,7 @@ async function handleOAuthUserInfo(c, opts) {
 			if (c.context.options.account?.storeAccountCookie) await setAccountCookie(c, createdAccount);
 			if (!userInfo.emailVerified && user && c.context.options.emailVerification?.sendOnSignUp && c.context.options.emailVerification?.sendVerificationEmail) {
 				const token = await createEmailVerificationToken(c.context.secret, user.email, void 0, c.context.options.emailVerification?.expiresIn);
-				const url = `${c.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
+				const url = `${c.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(callbackURL || "/")}`;
 				await c.context.runInBackgroundOrAwait(c.context.options.emailVerification.sendVerificationEmail({
 					user,
 					url,
@@ -135,5 +138,27 @@ async function handleOAuthUserInfo(c, opts) {
 		isRegister
 	};
 }
+/**
+* Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
+* copy the freshly linked provider's profile onto the local user, matching the
+* field set persisted on sign-up. The local `email` and `emailVerified` are
+* never changed, so a link can't rebind the account's identity, and
+* `updateUser` drops `undefined` fields, so a provider that omits one leaves
+* the existing column intact.
+*
+* Returns the updated user so a caller that issues a session can seed the
+* cookie cache with the fresh row. Returns `undefined` when the policy is
+* disabled or the update fails: a failed profile sync must not abort the link.
+*/
+async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
+	if (c.context.options.account?.accountLinking?.updateUserInfoOnLink !== true) return;
+	const { id: _id, email: _email, emailVerified: _emailVerified, ...profile } = userInfo;
+	try {
+		return await c.context.internalAdapter.updateUser(userId, profile);
+	} catch (e) {
+		c.context.logger.warn("Could not update user info on account link", e);
+		return;
+	}
+}
 //#endregion
-export { handleOAuthUserInfo };
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };

package/dist/oauth2/state.mjs

@@ -1,4 +1,5 @@
 import { generateRandomString } from "../crypto/random.mjs";
+import { redirectOnError } from "./errors.mjs";
 import { setOAuthState } from "../api/state/oauth.mjs";
 import { StateError, generateGenericState, parseGenericState } from "../state.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -36,8 +37,13 @@ async function parseState(c) {
 		parsedData = await parseGenericState(c, state);
 	} catch (error) {
 		c.context.logger.error("Failed to parse state", error);
-		if (error instanceof StateError && error.code === "state_security_mismatch") throw c.redirect(`${errorURL}?error=state_mismatch`);
-		throw c.redirect(`${errorURL}?error=please_restart_the_process`);
+		let code = "internal_server_error";
+		let redirectErrorURL = errorURL;
+		if (error instanceof StateError) {
+			code = error.code === "state_security_mismatch" ? "state_mismatch" : error.code;
+			redirectErrorURL = error.errorURL ?? errorURL;
+		}
+		redirectOnError(c, redirectErrorURL, code);
 	}
 	if (!parsedData.errorURL) parsedData.errorURL = errorURL;
 	if (parsedData) await setOAuthState(parsedData);

package/dist/{package.mjs → packages/better-auth/package.mjs}

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.0-beta.2";
+var version = "1.7.0-beta.4";
 //#endregion
 export { version };

package/dist/plugins/access/access.d.mts

@@ -1,4 +1,4 @@
-import { Statements, Subset } from "./types.mjs";
+import { ExactRoleStatements, Role, RoleInput, Statements } from "./types.mjs";
 
 //#region src/plugins/access/access.d.ts
 type AuthorizeResponse = {
@@ -8,21 +8,9 @@ type AuthorizeResponse = {
   success: true;
   error?: never | undefined;
 };
-declare function role<TStatements extends Statements>(statements: TStatements): {
-  authorize<K extends keyof TStatements>(request: { [key in K]?: TStatements[key] | {
-    actions: TStatements[key];
-    connector: "OR" | "AND";
-  } }, connector?: "OR" | "AND"): AuthorizeResponse;
-  statements: TStatements;
-};
+declare function role<const TRoleStatements extends Statements, TAuthorizeStatements extends Statements = TRoleStatements>(statements: TRoleStatements): Role<ExactRoleStatements<TRoleStatements>, TAuthorizeStatements>;
 declare function createAccessControl<const TStatements extends Statements>(s: TStatements): {
-  newRole<K extends keyof TStatements>(statements: Subset<K, TStatements>): {
-    authorize<K_1 extends K>(request: K_1 extends infer T extends keyof Subset<K, TStatements> ? { [key in T]?: Subset<K, TStatements>[key] | {
-      actions: Subset<K, TStatements>[key];
-      connector: "OR" | "AND";
-    } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
-    statements: Subset<K, TStatements>;
-  };
+  newRole<const TRoleStatements extends Statements>(statements: RoleInput<TStatements, TRoleStatements>): Role<ExactRoleStatements<TRoleStatements>, TStatements>;
   statements: TStatements;
 };
 //#endregion

package/dist/plugins/access/access.mjs

@@ -6,14 +6,19 @@ function role(statements) {
 			let success = false;
 			for (const [requestedResource, requestedActions] of Object.entries(request)) {
 				const allowedActions = statements[requestedResource];
-				if (!allowedActions) return {
-					success: false,
-					error: `You are not allowed to access resource: ${requestedResource}`
-				};
-				if (Array.isArray(requestedActions)) success = requestedActions.every((requestedAction) => allowedActions.includes(requestedAction));
+				if (!allowedActions) {
+					if (connector === "AND") return {
+						success: false,
+						error: `You are not allowed to access resource: ${requestedResource}`
+					};
+					success = false;
+					continue;
+				}
+				if (Array.isArray(requestedActions)) success = requestedActions.length > 0 && requestedActions.every((requestedAction) => allowedActions.includes(requestedAction));
 				else if (typeof requestedActions === "object") {
 					const actions = requestedActions;
-					if (actions.connector === "OR") success = actions.actions.some((requestedAction) => allowedActions.includes(requestedAction));
+					if (!Array.isArray(actions.actions) || actions.actions.length === 0) success = false;
+					else if (actions.connector === "OR") success = actions.actions.some((requestedAction) => allowedActions.includes(requestedAction));
 					else success = actions.actions.every((requestedAction) => allowedActions.includes(requestedAction));
 				} else throw new BetterAuthError("Invalid access control request");
 				if (success && connector === "OR") return { success };

package/dist/plugins/access/index.d.mts

@@ -1,3 +1,3 @@
-import { AccessControl, ArrayElement, Role, Statements, SubArray, Subset } from "./types.mjs";
+import { AccessControl, ArrayElement, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset } from "./types.mjs";
 import { AuthorizeResponse, createAccessControl, role } from "./access.mjs";
-export { AccessControl, ArrayElement, AuthorizeResponse, Role, Statements, SubArray, Subset, createAccessControl, role };
+export { AccessControl, ArrayElement, AuthorizeResponse, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset, createAccessControl, role };

package/dist/plugins/access/types.d.mts

@@ -8,10 +8,17 @@ type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly
 type Statements = {
   readonly [resource: string]: readonly LiteralString[];
 };
+type RoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]?: SubArray<TStatements[P]> };
+type RoleInput<TStatements extends Statements, TRoleStatements extends Statements> = TRoleStatements & (string extends keyof TRoleStatements ? {} : RoleStatements<TStatements> & Record<Exclude<keyof TRoleStatements, keyof TStatements>, never>);
+type ExactRoleStatements<TStatements extends Statements> = { readonly [P in keyof TStatements]: readonly [...TStatements[P]] };
 type AccessControl<TStatements extends Statements = Statements> = ReturnType<typeof createAccessControl<TStatements>>;
-type Role<TStatements extends Statements = Record<string, any>> = {
-  authorize: (request: any, connector?: ("OR" | "AND") | undefined) => AuthorizeResponse;
-  statements: TStatements;
+type RoleAuthorizeRequest<TStatements extends Statements> = { [P in keyof TStatements]?: SubArray<TStatements[P]> | {
+  actions: SubArray<TStatements[P]>;
+  connector: "OR" | "AND";
+} };
+type Role<TRoleStatements extends Statements = Record<string, any>, TAuthorizeStatements extends Statements = TRoleStatements> = {
+  authorize: (request: RoleAuthorizeRequest<TAuthorizeStatements>, connector?: ("OR" | "AND") | undefined) => AuthorizeResponse;
+  statements: TRoleStatements;
 };
 //#endregion
-export { AccessControl, ArrayElement, Role, Statements, SubArray, Subset };
+export { AccessControl, ArrayElement, ExactRoleStatements, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, Statements, SubArray, Subset };

package/dist/plugins/admin/access/statement.d.mts

@@ -1,115 +1,51 @@
-import { Subset } from "../../access/types.mjs";
-import { AuthorizeResponse } from "../../access/access.mjs";
+import { ExactRoleStatements, Role, RoleInput, Statements } from "../../access/types.mjs";
 //#region src/plugins/admin/access/statement.d.ts
 declare const defaultStatements: {
   readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
   readonly session: readonly ["list", "revoke", "delete"];
 };
 declare const defaultAc: {
-  newRole<K extends "user" | "session">(statements: Subset<K, {
+  newRole<const TRoleStatements extends Statements>(statements: RoleInput<{
     readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
-  }>): {
-    authorize<K_1 extends K>(request: K_1 extends infer T extends keyof Subset<K, {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }> ? { [key in T]?: Subset<K, {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }>[key] | {
-      actions: Subset<K, {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-        readonly session: readonly ["list", "revoke", "delete"];
-      }>[key];
-      connector: "OR" | "AND";
-    } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
-    statements: Subset<K, {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }>;
-  };
+  }, TRoleStatements>): Role<ExactRoleStatements<TRoleStatements>, {
+    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+    readonly session: readonly ["list", "revoke", "delete"];
+  }>;
   statements: {
     readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   };
 };
-declare const adminAc: {
-  authorize<K extends "user" | "session">(request: K extends infer T extends keyof Subset<"user" | "session", {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-    readonly session: readonly ["list", "revoke", "delete"];
-  }> ? { [key in T]?: Subset<"user" | "session", {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-    readonly session: readonly ["list", "revoke", "delete"];
-  }>[key] | {
-    actions: Subset<"user" | "session", {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }>[key];
-    connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
-  statements: Subset<"user" | "session", {
+declare const adminAc: Role<ExactRoleStatements<{
+  readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+  readonly session: ["list", "revoke", "delete"];
+}>, {
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+  readonly session: readonly ["list", "revoke", "delete"];
+}>;
+declare const userAc: Role<ExactRoleStatements<{
+  readonly user: [];
+  readonly session: [];
+}>, {
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+  readonly session: readonly ["list", "revoke", "delete"];
+}>;
+declare const defaultRoles: {
+  admin: Role<ExactRoleStatements<{
+    readonly user: ["create", "list", "set-role", "ban", "impersonate", "delete", "set-password", "get", "update"];
+    readonly session: ["list", "revoke", "delete"];
+  }>, {
     readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
-};
-declare const userAc: {
-  authorize<K extends "user" | "session">(request: K extends infer T extends keyof Subset<"user" | "session", {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-    readonly session: readonly ["list", "revoke", "delete"];
-  }> ? { [key in T]?: Subset<"user" | "session", {
-    readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-    readonly session: readonly ["list", "revoke", "delete"];
-  }>[key] | {
-    actions: Subset<"user" | "session", {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }>[key];
-    connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
-  statements: Subset<"user" | "session", {
+  user: Role<ExactRoleStatements<{
+    readonly user: [];
+    readonly session: [];
+  }>, {
     readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
     readonly session: readonly ["list", "revoke", "delete"];
   }>;
 };
-declare const defaultRoles: {
-  admin: {
-    authorize<K extends "user" | "session">(request: K extends infer T extends keyof Subset<"user" | "session", {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }> ? { [key in T]?: Subset<"user" | "session", {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }>[key] | {
-      actions: Subset<"user" | "session", {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-        readonly session: readonly ["list", "revoke", "delete"];
-      }>[key];
-      connector: "OR" | "AND";
-    } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
-    statements: Subset<"user" | "session", {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }>;
-  };
-  user: {
-    authorize<K extends "user" | "session">(request: K extends infer T extends keyof Subset<"user" | "session", {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }> ? { [key in T]?: Subset<"user" | "session", {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }>[key] | {
-      actions: Subset<"user" | "session", {
-        readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-        readonly session: readonly ["list", "revoke", "delete"];
-      }>[key];
-      connector: "OR" | "AND";
-    } | undefined } : never, connector?: "OR" | "AND"): AuthorizeResponse;
-    statements: Subset<"user" | "session", {
-      readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
-      readonly session: readonly ["list", "revoke", "delete"];
-    }>;
-  };
-};
 //#endregion
 export { adminAc, defaultAc, defaultRoles, defaultStatements, userAc };

package/dist/plugins/admin/admin.mjs

@@ -42,10 +42,6 @@ const admin = (options) => {
 							});
 							return;
 						}
-						if (ctx.path.startsWith("/callback")) {
-							const redirectURI = ctx.context.options.onAPIError?.errorURL || `${ctx.context.baseURL}/error`;
-							throw ctx.redirect(`${redirectURI}?error=banned&error_description=${opts.bannedUserMessage}`);
-						}
 						throw APIError.from("FORBIDDEN", {
 							message: opts.bannedUserMessage,
 							code: "BANNED_USER"

package/dist/plugins/admin/client.d.mts

@@ -44,8 +44,13 @@ declare const adminClient: <O extends AdminClientOptions>(options?: O | undefine
   };
   pathMethods: {
     "/admin/list-users": "GET";
+    "/admin/impersonate-user": "POST";
     "/admin/stop-impersonating": "POST";
   };
+  atomListeners: {
+    matcher: (path: string) => path is "/admin/impersonate-user" | "/admin/stop-impersonating";
+    signal: "$sessionSignal";
+  }[];
   $ERROR_CODES: {
     USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: _better_auth_core_utils_error_codes0.RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">;
     FAILED_TO_CREATE_USER: _better_auth_core_utils_error_codes0.RawError<"FAILED_TO_CREATE_USER">;
@@ -71,4 +76,4 @@ declare const adminClient: <O extends AdminClientOptions>(options?: O | undefine
   };
 };
 //#endregion
-export { adminClient };
+export { AdminClientOptions, adminClient };

package/dist/plugins/admin/client.mjs

@@ -25,8 +25,13 @@ const adminClient = (options) => {
 		} } }),
 		pathMethods: {
 			"/admin/list-users": "GET",
+			"/admin/impersonate-user": "POST",
 			"/admin/stop-impersonating": "POST"
 		},
+		atomListeners: [{
+			matcher: (path) => path === "/admin/impersonate-user" || path === "/admin/stop-impersonating",
+			signal: "$sessionSignal"
+		}],
 		$ERROR_CODES: ADMIN_ERROR_CODES
 	};
 };

package/dist/plugins/admin/routes.mjs

@@ -462,7 +462,7 @@ const banUser = (opts) => createAuthEndpoint("/admin/ban-user", {
 		banExpires: ctx.body.banExpiresIn ? getDate(ctx.body.banExpiresIn, "sec") : opts?.defaultBanExpiresIn ? getDate(opts.defaultBanExpiresIn, "sec") : void 0,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
-	await ctx.context.internalAdapter.deleteSessions(ctx.body.userId);
+	await ctx.context.internalAdapter.deleteUserSessions(ctx.body.userId);
 	return ctx.json({ user: parseUserOutput(ctx.context.options, user) });
 });
 const impersonateUserBodySchema = z.object({ userId: z.coerce.string().meta({ description: "The user id" }) });
@@ -658,7 +658,7 @@ const revokeUserSessions = (opts) => createAuthEndpoint("/admin/revoke-user-sess
 		options: opts,
 		permissions: { session: ["revoke"] }
 	})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS);
-	await ctx.context.internalAdapter.deleteSessions(ctx.body.userId);
+	await ctx.context.internalAdapter.deleteUserSessions(ctx.body.userId);
 	return ctx.json({ success: true });
 });
 const removeUserBodySchema = z.object({ userId: z.coerce.string().meta({ description: "The user id" }) });
@@ -703,6 +703,7 @@ const removeUser = (opts) => createAuthEndpoint("/admin/remove-user", {
 	})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS);
 	if (ctx.body.userId === ctx.context.session.user.id) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.YOU_CANNOT_REMOVE_YOURSELF);
 	if (!await ctx.context.internalAdapter.findUserById(ctx.body.userId)) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.USER_NOT_FOUND);
+	await ctx.context.internalAdapter.deleteUserSessions(ctx.body.userId);
 	await ctx.context.internalAdapter.deleteUser(ctx.body.userId);
 	return ctx.json({ success: true });
 });

package/dist/plugins/anonymous/client.d.mts

@@ -23,6 +23,7 @@ declare const anonymousClient: () => {
     COULD_NOT_CREATE_SESSION: _better_auth_core_utils_error_codes0.RawError<"COULD_NOT_CREATE_SESSION">;
     ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: _better_auth_core_utils_error_codes0.RawError<"ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY">;
     FAILED_TO_DELETE_ANONYMOUS_USER: _better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER">;
+    FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: _better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS">;
     USER_IS_NOT_ANONYMOUS: _better_auth_core_utils_error_codes0.RawError<"USER_IS_NOT_ANONYMOUS">;
     DELETE_ANONYMOUS_USER_DISABLED: _better_auth_core_utils_error_codes0.RawError<"DELETE_ANONYMOUS_USER_DISABLED">;
   };

package/dist/plugins/anonymous/error-codes.d.mts

@@ -7,6 +7,7 @@ declare const ANONYMOUS_ERROR_CODES: {
   COULD_NOT_CREATE_SESSION: _better_auth_core_utils_error_codes0.RawError<"COULD_NOT_CREATE_SESSION">;
   ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: _better_auth_core_utils_error_codes0.RawError<"ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY">;
   FAILED_TO_DELETE_ANONYMOUS_USER: _better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER">;
+  FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: _better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS">;
   USER_IS_NOT_ANONYMOUS: _better_auth_core_utils_error_codes0.RawError<"USER_IS_NOT_ANONYMOUS">;
   DELETE_ANONYMOUS_USER_DISABLED: _better_auth_core_utils_error_codes0.RawError<"DELETE_ANONYMOUS_USER_DISABLED">;
 };

package/dist/plugins/anonymous/error-codes.mjs

@@ -6,6 +6,7 @@ const ANONYMOUS_ERROR_CODES = defineErrorCodes({
 	COULD_NOT_CREATE_SESSION: "Could not create session",
 	ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: "Anonymous users cannot sign in again anonymously",
 	FAILED_TO_DELETE_ANONYMOUS_USER: "Failed to delete anonymous user",
+	FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: "Failed to delete anonymous user sessions",
 	USER_IS_NOT_ANONYMOUS: "User is not anonymous",
 	DELETE_ANONYMOUS_USER_DISABLED: "Deleting anonymous users is disabled"
 });

package/dist/plugins/anonymous/index.d.mts

@@ -162,6 +162,7 @@ declare const anonymous: (options?: AnonymousOptions | undefined) => {
     COULD_NOT_CREATE_SESSION: _better_auth_core_utils_error_codes0.RawError<"COULD_NOT_CREATE_SESSION">;
     ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY: _better_auth_core_utils_error_codes0.RawError<"ANONYMOUS_USERS_CANNOT_SIGN_IN_AGAIN_ANONYMOUSLY">;
     FAILED_TO_DELETE_ANONYMOUS_USER: _better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER">;
+    FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS: _better_auth_core_utils_error_codes0.RawError<"FAILED_TO_DELETE_ANONYMOUS_USER_SESSIONS">;
     USER_IS_NOT_ANONYMOUS: _better_auth_core_utils_error_codes0.RawError<"USER_IS_NOT_ANONYMOUS">;
     DELETE_ANONYMOUS_USER_DISABLED: _better_auth_core_utils_error_codes0.RawError<"DELETE_ANONYMOUS_USER_DISABLED">;
   };