better-auth 1.7.0-beta.6 → 1.7.0-beta.8

package/dist/api/index.d.mts

@@ -100,7 +100,6 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
           accessToken: zod.ZodOptional<zod.ZodString>;
           refreshToken: zod.ZodOptional<zod.ZodString>;
           expiresAt: zod.ZodOptional<zod.ZodNumber>;
-          scopes: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
           user: zod.ZodOptional<zod.ZodObject<{
             name: zod.ZodOptional<zod.ZodObject<{
               firstName: zod.ZodOptional<zod.ZodString>;
@@ -129,7 +128,6 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
               accessToken: zod.ZodOptional<zod.ZodString>;
               refreshToken: zod.ZodOptional<zod.ZodString>;
               expiresAt: zod.ZodOptional<zod.ZodNumber>;
-              scopes: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
               user: zod.ZodOptional<zod.ZodObject<{
                 name: zod.ZodOptional<zod.ZodObject<{
                   firstName: zod.ZodOptional<zod.ZodString>;
@@ -1584,7 +1582,6 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
           nonce: zod.ZodOptional<zod.ZodString>;
           accessToken: zod.ZodOptional<zod.ZodString>;
           refreshToken: zod.ZodOptional<zod.ZodString>;
-          scopes: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
         }, zod_v4_core0.$strip>>;
         requestSignUp: zod.ZodOptional<zod.ZodBoolean>;
         scopes: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
@@ -1712,7 +1709,7 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
                         userId: {
                           type: string;
                         };
-                        grantedScopes: {
+                        scopes: {
                           type: string;
                           items: {
                             type: string;
@@ -1729,7 +1726,7 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
         };
       };
     }, {
-      grantedScopes: string[];
+      scopes: string[];
       id: string;
       createdAt: Date;
       updatedAt: Date;
@@ -1869,12 +1866,6 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
                         type: string;
                         format: string;
                       };
-                      grantedScopes: {
-                        type: string;
-                        items: {
-                          type: string;
-                        };
-                      };
                     };
                   };
                 };
@@ -1891,7 +1882,7 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
       refreshToken: string;
       accessTokenExpiresAt: Date | undefined;
       refreshTokenExpiresAt: Date | null | undefined;
-      grantedScopes: string[];
+      scope: string | null | undefined;
       idToken: string | null | undefined;
       providerId: string;
       accountId: string;
@@ -1941,7 +1932,7 @@ declare function getEndpoints<Option extends BetterAuthOptions>(ctx: Awaitable<A
     }, {
       accessToken: string;
       accessTokenExpiresAt: Date | undefined;
-      grantedScopes: string[];
+      scopes: string[];
       idToken: string | undefined;
     }>;
     readonly accountInfo: better_call0.StrictEndpoint<"/account-info", {
@@ -2084,7 +2075,6 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
           accessToken: zod.ZodOptional<zod.ZodString>;
           refreshToken: zod.ZodOptional<zod.ZodString>;
           expiresAt: zod.ZodOptional<zod.ZodNumber>;
-          scopes: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
           user: zod.ZodOptional<zod.ZodObject<{
             name: zod.ZodOptional<zod.ZodObject<{
               firstName: zod.ZodOptional<zod.ZodString>;
@@ -2113,7 +2103,6 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
               accessToken: zod.ZodOptional<zod.ZodString>;
               refreshToken: zod.ZodOptional<zod.ZodString>;
               expiresAt: zod.ZodOptional<zod.ZodNumber>;
-              scopes: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
               user: zod.ZodOptional<zod.ZodObject<{
                 name: zod.ZodOptional<zod.ZodObject<{
                   firstName: zod.ZodOptional<zod.ZodString>;
@@ -3568,7 +3557,6 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
           nonce: zod.ZodOptional<zod.ZodString>;
           accessToken: zod.ZodOptional<zod.ZodString>;
           refreshToken: zod.ZodOptional<zod.ZodString>;
-          scopes: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
         }, zod_v4_core0.$strip>>;
         requestSignUp: zod.ZodOptional<zod.ZodBoolean>;
         scopes: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
@@ -3696,7 +3684,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
                         userId: {
                           type: string;
                         };
-                        grantedScopes: {
+                        scopes: {
                           type: string;
                           items: {
                             type: string;
@@ -3713,7 +3701,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
         };
       };
     }, {
-      grantedScopes: string[];
+      scopes: string[];
       id: string;
       createdAt: Date;
       updatedAt: Date;
@@ -3853,12 +3841,6 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
                         type: string;
                         format: string;
                       };
-                      grantedScopes: {
-                        type: string;
-                        items: {
-                          type: string;
-                        };
-                      };
                     };
                   };
                 };
@@ -3875,7 +3857,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
       refreshToken: string;
       accessTokenExpiresAt: Date | undefined;
       refreshTokenExpiresAt: Date | null | undefined;
-      grantedScopes: string[];
+      scope: string | null | undefined;
       idToken: string | null | undefined;
       providerId: string;
       accountId: string;
@@ -3925,7 +3907,7 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
     }, {
       accessToken: string;
       accessTokenExpiresAt: Date | undefined;
-      grantedScopes: string[];
+      scopes: string[];
       idToken: string | undefined;
     }>;
     readonly accountInfo: better_call0.StrictEndpoint<"/account-info", {

package/dist/api/routes/account.d.mts

@@ -62,7 +62,7 @@ declare const listUserAccounts: better_call0.StrictEndpoint<"/list-accounts", {
                     userId: {
                       type: string;
                     };
-                    grantedScopes: {
+                    scopes: {
                       type: string;
                       items: {
                         type: string;
@@ -79,7 +79,7 @@ declare const listUserAccounts: better_call0.StrictEndpoint<"/list-accounts", {
     };
   };
 }, {
-  grantedScopes: string[];
+  scopes: string[];
   id: string;
   createdAt: Date;
   updatedAt: Date;
@@ -98,7 +98,6 @@ declare const linkSocialAccount: better_call0.StrictEndpoint<"/link-social", {
       nonce: z.ZodOptional<z.ZodString>;
       accessToken: z.ZodOptional<z.ZodString>;
       refreshToken: z.ZodOptional<z.ZodString>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
     requestSignUp: z.ZodOptional<z.ZodBoolean>;
     scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -266,7 +265,7 @@ declare const getAccessToken: better_call0.StrictEndpoint<"/get-access-token", {
 }, {
   accessToken: string;
   accessTokenExpiresAt: Date | undefined;
-  grantedScopes: string[];
+  scopes: string[];
   idToken: string | undefined;
 }>;
 declare const refreshToken: better_call0.StrictEndpoint<"/refresh-token", {
@@ -307,12 +306,6 @@ declare const refreshToken: better_call0.StrictEndpoint<"/refresh-token", {
                     type: string;
                     format: string;
                   };
-                  grantedScopes: {
-                    type: string;
-                    items: {
-                      type: string;
-                    };
-                  };
                 };
               };
             };
@@ -329,7 +322,7 @@ declare const refreshToken: better_call0.StrictEndpoint<"/refresh-token", {
   refreshToken: string;
   accessTokenExpiresAt: Date | undefined;
   refreshTokenExpiresAt: Date | null | undefined;
-  grantedScopes: string[];
+  scope: string | null | undefined;
   idToken: string | null | undefined;
   providerId: string;
   accountId: string;

package/dist/api/routes/account.mjs

@@ -1,20 +1,22 @@
 import { shouldBindAccountCookieToSessionUser } from "../../context/store-capabilities.mjs";
 import { parseAccountOutput } from "../../db/schema.mjs";
-import { generateRandomString } from "../../crypto/random.mjs";
-import { getAccountCookie } from "../../cookies/session-store.mjs";
+import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
 import { missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { decryptOAuthToken } from "../../oauth2/token-encryption.mjs";
-import { persistOAuthAccount } from "../../oauth2/persist-account.mjs";
-import { applyUpdateUserInfoOnLink } from "../../oauth2/resolve-account.mjs";
-import { generateState } from "../../oauth2/state.mjs";
+import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
+import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
+import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
 import { freshSessionMiddleware, getSessionFromCtx, isStateful, sessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
-import { additionalAuthorizationParamsSchema, readGrantedScopes, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
+import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/api/routes/account.ts
+function parseStoredScopes(scope) {
+	if (!scope) return [];
+	return scope.split(",").map((s) => s.trim()).filter(Boolean);
+}
 const listUserAccounts = createAuthEndpoint("/list-accounts", {
 	method: "GET",
 	use: [sessionMiddleware],
@@ -40,7 +42,7 @@ const listUserAccounts = createAuthEndpoint("/list-accounts", {
 						},
 						accountId: { type: "string" },
 						userId: { type: "string" },
-						grantedScopes: {
+						scopes: {
 							type: "array",
 							items: { type: "string" }
 						}
@@ -52,7 +54,7 @@ const listUserAccounts = createAuthEndpoint("/list-accounts", {
 						"updatedAt",
 						"accountId",
 						"userId",
-						"grantedScopes"
+						"scopes"
 					]
 				}
 			} } }
@@ -62,10 +64,10 @@ const listUserAccounts = createAuthEndpoint("/list-accounts", {
 	const session = c.context.session;
 	const accounts = await c.context.internalAdapter.findAccounts(session.user.id);
 	return c.json(accounts.map((a) => {
-		const { grantedScopes, ...parsed } = parseAccountOutput(c.context.options, a);
+		const { scope, ...parsed } = parseAccountOutput(c.context.options, a);
 		return {
 			...parsed,
-			grantedScopes: readGrantedScopes(grantedScopes)
+			scopes: parseStoredScopes(scope)
 		};
 	}));
 });
@@ -79,8 +81,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			token: z.string(),
 			nonce: z.string().optional(),
 			accessToken: z.string().optional(),
-			refreshToken: z.string().optional(),
-			scopes: z.array(z.string()).optional()
+			refreshToken: z.string().optional()
 		}).optional(),
 		requestSignUp: z.boolean().optional(),
 		scopes: z.array(z.string()).meta({ description: "Additional scopes to request from the provider" }).optional(),
@@ -158,18 +159,15 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			code: "LINKING_DIFFERENT_EMAILS_NOT_ALLOWED"
 		});
 		try {
-			await persistOAuthAccount(c, {
+			await c.context.internalAdapter.createAccount({
 				userId: session.user.id,
 				providerId: provider.id,
 				accountId: linkingUserId,
-				tokens: {
-					accessToken: c.body.idToken.accessToken,
-					refreshToken: c.body.idToken.refreshToken,
-					idToken: token
-				},
-				mode: "link"
+				accessToken: c.body.idToken.accessToken,
+				idToken: token,
+				refreshToken: c.body.idToken.refreshToken
 			});
-		} catch (_e) {
+		} catch {
 			throw APIError.from("EXPECTATION_FAILED", {
 				message: "Account not linked - unable to create account",
 				code: "LINKING_FAILED"
@@ -182,25 +180,23 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			redirect: false
 		});
 	}
-	const stateNonce = generateRandomString(32);
-	const codeVerifier = generateRandomString(128);
-	const { url, requestedScopes } = await provider.createAuthorizationURL({
-		state: stateNonce,
-		codeVerifier,
-		redirectURI: `${c.context.baseURL}${provider.callbackPath}`,
-		scopes: c.body.scopes,
-		loginHint: c.body.loginHint,
-		additionalParams: c.body.additionalParams
-	});
-	await generateState(c, {
+	const idTokenNonce = generateIdTokenNonce(provider);
+	const state = await generateState(c, {
 		link: {
 			userId: session.user.id,
 			email: session.user.email
 		},
 		additionalData: c.body.additionalData,
-		requestedScopes,
-		state: stateNonce,
-		codeVerifier
+		idTokenNonce
+	});
+	const url = await provider.createAuthorizationURL({
+		state: state.state,
+		codeVerifier: state.codeVerifier,
+		idTokenNonce,
+		redirectURI: `${c.context.baseURL}${getOAuthCallbackPath(provider)}`,
+		scopes: c.body.scopes,
+		loginHint: c.body.loginHint,
+		additionalParams: c.body.additionalParams
 	});
 	if (!c.body.disableRedirect) c.setHeader("Location", url.toString());
 	return c.json({
@@ -273,7 +269,7 @@ async function getValidAccessToken(ctx, { resolvedUserId, providerId, accountId,
 	const provider = await getAwaitableValue(ctx.context.socialProviders, { value: providerId });
 	if (!provider) throw APIError.from("BAD_REQUEST", {
 		message: `Provider ${providerId} is not supported.`,
-		code: BASE_ERROR_CODES.PROVIDER_NOT_SUPPORTED.code
+		code: "PROVIDER_NOT_SUPPORTED"
 	});
 	let account = resolvedAccount;
 	if (!account) {
@@ -291,13 +287,19 @@ async function getValidAccessToken(ctx, { resolvedUserId, providerId, accountId,
 		const accessTokenExpired = account.accessTokenExpiresAt && new Date(account.accessTokenExpiresAt).getTime() - Date.now() < 5e3;
 		if (account.refreshToken && accessTokenExpired && provider.refreshAccessToken) {
 			const refreshToken = await decryptOAuthToken(account.refreshToken, ctx.context);
-			newTokens = await provider.refreshAccessToken(refreshToken);
-			await persistOAuthAccount(ctx, {
-				userId: account.userId,
-				providerId: account.providerId,
-				accountId: account.accountId,
-				tokens: newTokens,
-				mode: "refresh"
+			newTokens = await provider.refreshAccessToken(refreshToken, ctx);
+			const updatedData = {
+				accessToken: await setTokenUtil(newTokens?.accessToken, ctx.context),
+				accessTokenExpiresAt: newTokens?.accessTokenExpiresAt,
+				refreshToken: newTokens?.refreshToken ? await setTokenUtil(newTokens.refreshToken, ctx.context) : account.refreshToken,
+				refreshTokenExpiresAt: newTokens?.refreshTokenExpiresAt ?? account.refreshTokenExpiresAt,
+				idToken: newTokens?.idToken || account.idToken
+			};
+			let updatedAccount = null;
+			if (account.id) updatedAccount = await ctx.context.internalAdapter.updateAccount(account.id, updatedData);
+			if (ctx.context.options.account?.storeAccountCookie) await setAccountCookie(ctx, {
+				...account,
+				...updatedAccount ?? updatedData
 			});
 		}
 		const accessTokenExpiresAt = (() => {
@@ -313,12 +315,14 @@ async function getValidAccessToken(ctx, { resolvedUserId, providerId, accountId,
 		return {
 			accessToken: newTokens?.accessToken ?? await decryptOAuthToken(account.accessToken ?? "", ctx.context),
 			accessTokenExpiresAt,
-			grantedScopes: readGrantedScopes(account.grantedScopes),
+			scopes: parseStoredScopes(account.scope),
 			idToken: newTokens?.idToken ?? account.idToken ?? void 0
 		};
-	} catch (error) {
-		ctx.context.logger.error("Failed to get a valid access token", error);
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_GET_ACCESS_TOKEN);
+	} catch (_error) {
+		throw APIError.from("BAD_REQUEST", {
+			message: "Failed to get a valid access token",
+			code: "FAILED_TO_GET_ACCESS_TOKEN"
+		});
 	}
 }
 const getAccessToken = createAuthEndpoint("/get-access-token", {
@@ -384,10 +388,6 @@ const refreshToken = createAuthEndpoint("/refresh-token", {
 						refreshTokenExpiresAt: {
 							type: "string",
 							format: "date-time"
-						},
-						grantedScopes: {
-							type: "array",
-							items: { type: "string" }
 						}
 					}
 				} } }
@@ -401,11 +401,11 @@ const refreshToken = createAuthEndpoint("/refresh-token", {
 	const provider = await getAwaitableValue(ctx.context.socialProviders, { value: providerId });
 	if (!provider) throw APIError.from("BAD_REQUEST", {
 		message: `Provider ${providerId} is not supported.`,
-		code: BASE_ERROR_CODES.PROVIDER_NOT_SUPPORTED.code
+		code: "PROVIDER_NOT_SUPPORTED"
 	});
 	if (!provider.refreshAccessToken) throw APIError.from("BAD_REQUEST", {
 		message: `Provider ${providerId} does not support token refreshing.`,
-		code: BASE_ERROR_CODES.TOKEN_REFRESH_NOT_SUPPORTED.code
+		code: "TOKEN_REFRESH_NOT_SUPPORTED"
 	});
 	let account = void 0;
 	const accountData = await getAccountCookie(ctx);
@@ -417,30 +417,50 @@ const refreshToken = createAuthEndpoint("/refresh-token", {
 	else account = (await ctx.context.internalAdapter.findAccounts(resolvedUserId)).find((acc) => accountId ? acc.accountId === accountId && acc.providerId === providerId : acc.providerId === providerId);
 	if (!account) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.ACCOUNT_NOT_FOUND);
 	const refreshToken = account.refreshToken ?? void 0;
-	if (!refreshToken) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.REFRESH_TOKEN_NOT_FOUND);
+	if (!refreshToken) throw APIError.from("BAD_REQUEST", {
+		message: "Refresh token not found",
+		code: "REFRESH_TOKEN_NOT_FOUND"
+	});
 	try {
 		const decryptedRefreshToken = await decryptOAuthToken(refreshToken, ctx.context);
-		const tokens = await provider.refreshAccessToken(decryptedRefreshToken);
-		await persistOAuthAccount(ctx, {
-			userId: account.userId,
-			providerId: account.providerId,
-			accountId: account.accountId,
-			tokens,
-			mode: "refresh"
+		const tokens = await provider.refreshAccessToken(decryptedRefreshToken, ctx);
+		const resolvedRefreshToken = tokens.refreshToken ? await setTokenUtil(tokens.refreshToken, ctx.context) : refreshToken;
+		const resolvedRefreshTokenExpiresAt = tokens.refreshTokenExpiresAt ?? account.refreshTokenExpiresAt;
+		const updatedTokenData = {
+			accessToken: await setTokenUtil(tokens.accessToken, ctx.context),
+			refreshToken: resolvedRefreshToken,
+			accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+			refreshTokenExpiresAt: resolvedRefreshTokenExpiresAt,
+			idToken: tokens.idToken || account.idToken
+		};
+		let updatedAccount = null;
+		if (account.id)
+ /**
+		* `scope` intentionally omitted. Refresh response may be narrower.
+		*
+		* @see {@link Account.scope}
+		*/
+		updatedAccount = await ctx.context.internalAdapter.updateAccount(account.id, updatedTokenData);
+		if (accountData && providerId === accountData.providerId && ctx.context.options.account?.storeAccountCookie) await setAccountCookie(ctx, {
+			...accountData,
+			...updatedAccount ?? updatedTokenData
 		});
+		const responseScope = updatedAccount?.scope ?? account.scope;
 		return ctx.json({
 			accessToken: tokens.accessToken,
 			refreshToken: tokens.refreshToken ?? decryptedRefreshToken,
 			accessTokenExpiresAt: tokens.accessTokenExpiresAt,
-			refreshTokenExpiresAt: tokens.refreshTokenExpiresAt ?? account.refreshTokenExpiresAt,
-			grantedScopes: readGrantedScopes(account.grantedScopes),
+			refreshTokenExpiresAt: resolvedRefreshTokenExpiresAt,
+			scope: responseScope,
 			idToken: tokens.idToken || account.idToken,
 			providerId: account.providerId,
 			accountId: account.accountId
 		});
-	} catch (error) {
-		ctx.context.logger.error("Failed to refresh access token", error);
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.FAILED_TO_REFRESH_ACCESS_TOKEN);
+	} catch (_error) {
+		throw APIError.from("BAD_REQUEST", {
+			message: "Failed to refresh access token",
+			code: "FAILED_TO_REFRESH_ACCESS_TOKEN"
+		});
 	}
 });
 const accountInfoQuerySchema = z.optional(z.object({

package/dist/api/routes/callback.mjs

@@ -1,14 +1,13 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
-import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { assertValidUserInfo } from "../../utils/validate-user-info.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { persistOAuthAccount } from "../../oauth2/persist-account.mjs";
-import { applyUpdateUserInfoOnLink } from "../../oauth2/resolve-account.mjs";
-import { generateState, parseState } from "../../oauth2/state.mjs";
-import { signInWithOAuthIdentity } from "../../oauth2/sign-in-with-oauth-identity.mjs";
+import { getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { generateIdTokenNonce, generateState, parseState } from "../../oauth2/state.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import { mergeScopes } from "@better-auth/core/oauth2";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -58,17 +57,13 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 	if (state === void 0 && code) {
 		const provider = await getAwaitableValue(c.context.socialProviders, { value: c.params.id });
 		if (provider?.allowIdpInitiated) {
-			const state = generateRandomString(32);
-			const codeVerifier = generateRandomString(128);
-			const { url: authUrl, requestedScopes } = await provider.createAuthorizationURL({
-				state,
+			const idTokenNonce = generateIdTokenNonce(provider);
+			const { state: freshState, codeVerifier } = await generateState(c, { idTokenNonce });
+			const authUrl = await provider.createAuthorizationURL({
+				state: freshState,
 				codeVerifier,
-				redirectURI: `${c.context.baseURL}${provider.callbackPath}`
-			});
-			await generateState(c, {
-				requestedScopes,
-				state,
-				codeVerifier
+				idTokenNonce,
+				redirectURI: `${c.context.baseURL}${getOAuthCallbackPath(provider)}`
 			});
 			throw c.redirect(authUrl.toString());
 		}
@@ -78,7 +73,7 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		const url = `${defaultErrorURL}${defaultErrorURL.includes("?") ? "&" : "?"}error=state_not_found`;
 		throw c.redirect(url);
 	}
-	const { codeVerifier, callbackURL, link, errorURL, newUserURL, requestSignUp, requestedScopes } = await parseState(c);
+	const { codeVerifier, callbackURL, link, errorURL, newUserURL, requestSignUp, idTokenNonce } = await parseState(c);
 	function redirectOnError(error, description) {
 		const baseURL = errorURL ?? defaultErrorURL;
 		const params = new URLSearchParams({ error });
@@ -103,13 +98,17 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		});
 		throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.ISSUER_MISMATCH);
 	}
+	if (provider.requiresIdTokenNonce && !idTokenNonce) {
+		c.context.logger.error("OAuth id_token nonce binding required but no expected nonce was found in state", { providerId: provider.id });
+		throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.NONCE_BINDING_MISSING);
+	}
 	let tokens;
 	try {
 		tokens = await provider.validateAuthorizationCode({
 			code,
 			codeVerifier,
 			deviceId: device_id,
-			redirectURI: `${c.context.baseURL}${provider.callbackPath}`
+			redirectURI: `${c.context.baseURL}${getOAuthCallbackPath(provider)}`
 		});
 	} catch (e) {
 		c.context.logger.error("", e);
@@ -119,6 +118,7 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 	const parsedUserData = userData ? safeJSONParse(userData) : null;
 	const providerResult = await provider.getUserInfo({
 		...tokens,
+		...idTokenNonce ? { expectedIdTokenNonce: idTokenNonce } : {},
 		user: parsedUserData ?? void 0
 	});
 	if (!providerResult?.user || providerResult.user.id === void 0 || providerResult.user.id === null || providerResult.user.id === "") {
@@ -158,15 +158,26 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		}
 		if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.EMAIL_DOES_NOT_MATCH);
 		const existingAccount = await c.context.internalAdapter.findAccountByProviderId(providerAccountId, provider.id);
-		if (existingAccount && existingAccount.userId.toString() !== link.userId.toString()) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.ACCOUNT_ALREADY_LINKED_TO_DIFFERENT_USER);
-		if (!await persistOAuthAccount(c, {
+		if (existingAccount) {
+			if (existingAccount.userId.toString() !== link.userId.toString()) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.ACCOUNT_ALREADY_LINKED_TO_DIFFERENT_USER);
+			const mergedScope = mergeScopes(existingAccount.scope, tokens.scopes);
+			const updateData = Object.fromEntries(Object.entries({
+				accessToken: await setTokenUtil(tokens.accessToken, c.context),
+				refreshToken: await setTokenUtil(tokens.refreshToken, c.context),
+				idToken: tokens.idToken,
+				accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+				refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
+				scope: mergedScope || void 0
+			}).filter(([_, value]) => value !== void 0));
+			await c.context.internalAdapter.updateAccount(existingAccount.id, updateData);
+		} else if (!await c.context.internalAdapter.createAccount({
 			userId: link.userId,
 			providerId: provider.id,
 			accountId: providerAccountId,
-			tokens,
-			requestedScopes,
-			mode: "link",
-			grantAuthority: provider.grantAuthority
+			...tokens,
+			accessToken: await setTokenUtil(tokens.accessToken, c.context),
+			refreshToken: await setTokenUtil(tokens.refreshToken, c.context),
+			scope: tokens.scopes?.join(",")
 		})) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
 		await applyUpdateUserInfoOnLink(c, link.userId, userInfo);
 		let toRedirectTo;
@@ -181,19 +192,22 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		c.context.logger.error(missingEmailLogMessage(provider.id));
 		return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_FOUND);
 	}
+	const accountData = {
+		providerId: provider.id,
+		accountId: providerAccountId,
+		...tokens,
+		scope: tokens.scopes?.join(",")
+	};
 	let result;
 	try {
-		result = await signInWithOAuthIdentity(c, {
+		result = await handleOAuthUserInfo(c, {
 			userInfo: {
 				...userInfo,
 				id: providerAccountId,
 				email: userInfo.email,
 				name: userInfo.name || ""
 			},
-			providerId: provider.id,
-			accountId: providerAccountId,
-			tokens,
-			requestedScopes,
+			account: accountData,
 			callbackURL,
 			disableSignUp: provider.disableImplicitSignUp && !requestSignUp || provider.options?.disableSignUp,
 			overrideUserInfo: provider.options?.overrideUserInfoOnSignIn,
@@ -203,8 +217,7 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 					providerId: provider.id,
 					profile: providerResult.data
 				}
-			},
-			grantAuthority: provider.grantAuthority
+			}
 		});
 	} catch (e) {
 		if (isAPIError(e) && e.body?.code) redirectOnError(e.body.code, e.body.message);

package/dist/api/routes/sign-in.d.mts

@@ -16,7 +16,6 @@ declare const socialSignInBodySchema: z.ZodObject<{
     accessToken: z.ZodOptional<z.ZodString>;
     refreshToken: z.ZodOptional<z.ZodString>;
     expiresAt: z.ZodOptional<z.ZodNumber>;
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     user: z.ZodOptional<z.ZodObject<{
       name: z.ZodOptional<z.ZodObject<{
         firstName: z.ZodOptional<z.ZodString>;
@@ -46,7 +45,6 @@ declare const signInSocial: <O extends BetterAuthOptions>() => better_call0.Stri
       accessToken: z.ZodOptional<z.ZodString>;
       refreshToken: z.ZodOptional<z.ZodString>;
       expiresAt: z.ZodOptional<z.ZodNumber>;
-      scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
       user: z.ZodOptional<z.ZodObject<{
         name: z.ZodOptional<z.ZodObject<{
           firstName: z.ZodOptional<z.ZodString>;