better-auth 1.7.0-beta.7 → 1.7.0-beta.9

package/dist/api/routes/sign-in.mjs

@@ -1,11 +1,11 @@
 import { formCsrfMiddleware } from "../middlewares/origin-check.mjs";
 import { parseUserOutput } from "../../db/schema.mjs";
-import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
+import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
+import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
-import { signInWithOAuthIdentity } from "../../oauth2/sign-in-with-oauth-identity.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
@@ -25,7 +25,6 @@ const socialSignInBodySchema = z.object({
 		accessToken: z.string().meta({ description: "Access token from the provider" }).optional(),
 		refreshToken: z.string().meta({ description: "Refresh token from the provider" }).optional(),
 		expiresAt: z.number().meta({ description: "Expiry date of the token" }).optional(),
-		scopes: z.array(z.string()).meta({ description: "The scopes granted alongside the id token" }).optional(),
 		user: z.object({
 			name: z.object({
 				firstName: z.string().optional(),
@@ -101,7 +100,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			c.context.logger.error(missingEmailLogMessage(c.body.provider, { source: "id_token" }), { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.USER_EMAIL_NOT_FOUND);
 		}
-		const data = await signInWithOAuthIdentity(c, {
+		const data = await handleOAuthUserInfo(c, {
 			userInfo: {
 				...userInfo.user,
 				email: userInfo.user.email,
@@ -110,12 +109,10 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 				image: userInfo.user.image,
 				emailVerified: userInfo.user.emailVerified || false
 			},
-			providerId: provider.id,
-			accountId: String(userInfo.user.id),
-			tokens: {
-				idToken: token,
-				accessToken: c.body.idToken.accessToken,
-				refreshToken: c.body.idToken.refreshToken
+			account: {
+				providerId: provider.id,
+				accountId: String(userInfo.user.id),
+				accessToken: c.body.idToken.accessToken
 			},
 			callbackURL: c.body.callbackURL,
 			disableSignUp: provider.disableImplicitSignUp && !c.body.requestSignUp || provider.disableSignUp,
@@ -142,25 +139,20 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			user: parseUserOutput(c.context.options, data.data.user)
 		});
 	}
-	const state = generateRandomString(32);
-	const codeVerifier = generateRandomString(128);
 	const idTokenNonce = generateIdTokenNonce(provider);
-	const { url, requestedScopes } = await provider.createAuthorizationURL({
+	const { codeVerifier, state } = await generateState(c, {
+		additionalData: c.body.additionalData,
+		idTokenNonce
+	});
+	const url = await provider.createAuthorizationURL({
 		state,
 		codeVerifier,
 		idTokenNonce,
-		redirectURI: `${c.context.baseURL}${provider.callbackPath}`,
+		redirectURI: `${c.context.baseURL}${getOAuthCallbackPath(provider)}`,
 		scopes: c.body.scopes,
 		loginHint: c.body.loginHint,
 		additionalParams: c.body.additionalParams
 	});
-	await generateState(c, {
-		additionalData: c.body.additionalData,
-		requestedScopes,
-		state,
-		codeVerifier,
-		idTokenNonce
-	});
 	if (!c.body.disableRedirect) c.setHeader("Location", url.toString());
 	return c.json({
 		url: url.toString(),

package/dist/cookies/session-store.d.mts

@@ -24,7 +24,7 @@ declare function getAccountCookie(c: GenericEndpointContext): Promise<{
   idToken?: string | null | undefined;
   accessTokenExpiresAt?: Date | null | undefined;
   refreshTokenExpiresAt?: Date | null | undefined;
-  grantedScopes?: string[] | null | undefined;
+  scope?: string | null | undefined;
   password?: string | null | undefined;
 } | null>;
 //#endregion

package/dist/db/get-migration.mjs

@@ -87,40 +87,7 @@ function matchType(columnDataType, fieldType, dbType) {
 	function normalize(type) {
 		return type.toLowerCase().split("(")[0].trim();
 	}
-	if (fieldType === "string[]" || fieldType === "number[]") {
-		const normalized = normalize(columnDataType);
-		if (map[dbType].json.map((t) => t.toLowerCase()).includes(normalized)) return true;
-		if (dbType === "postgres") {
-			const element = columnDataType.toLowerCase().replace(/^_/, "").replace(/\[\]$/, "").trim();
-			return (fieldType === "string[]" ? new Set([
-				"text",
-				"varchar",
-				"character varying",
-				"char",
-				"character",
-				"bpchar",
-				"name",
-				"uuid",
-				"citext"
-			]) : new Set([
-				"int",
-				"int2",
-				"int4",
-				"int8",
-				"integer",
-				"smallint",
-				"bigint",
-				"numeric",
-				"decimal",
-				"real",
-				"float4",
-				"float8",
-				"double precision",
-				"money"
-			])).has(element);
-		}
-		return false;
-	}
+	if (fieldType === "string[]" || fieldType === "number[]") return columnDataType.toLowerCase().includes("json");
 	const types = map[dbType];
 	return (Array.isArray(fieldType) ? types["string"].map((t) => t.toLowerCase()) : types[fieldType].map((t) => t.toLowerCase())).includes(normalize(columnDataType));
 }

package/dist/db/internal-adapter.mjs

@@ -89,6 +89,26 @@ const createInternalAdapter = (adapter, ctx) => {
 		}
 	}
 	return {
+		createOAuthUser: async (user, account) => {
+			return runWithTransaction(adapter, async () => {
+				const createdUser = await createWithHooks({
+					createdAt: /* @__PURE__ */ new Date(),
+					updatedAt: /* @__PURE__ */ new Date(),
+					...user,
+					email: user.email?.toLowerCase()
+				}, "user", void 0);
+				if (!createdUser) throw new APIError("BAD_REQUEST", { message: "Failed to create user" });
+				return {
+					user: createdUser,
+					account: await createWithHooks({
+						...account,
+						userId: createdUser.id,
+						createdAt: /* @__PURE__ */ new Date(),
+						updatedAt: /* @__PURE__ */ new Date()
+					}, "account", void 0)
+				};
+			});
+		},
 		createUser: async (user, source) => {
 			const data = {
 				createdAt: /* @__PURE__ */ new Date(),

package/dist/db/schema.d.mts

@@ -37,7 +37,7 @@ declare function parseAccountInput(options: BetterAuthOptions, account: Partial<
   idToken?: string | null | undefined;
   accessTokenExpiresAt?: Date | null | undefined;
   refreshTokenExpiresAt?: Date | null | undefined;
-  grantedScopes?: string[] | null | undefined;
+  scope?: string | null | undefined;
   password?: string | null | undefined;
 }>>;
 declare function parseSessionInput(options: BetterAuthOptions, session: Partial<Session$1>, action?: "create" | "update"): Partial<Partial<{

package/dist/oauth2/index.d.mts

@@ -1,7 +1,5 @@
 import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "./state.mjs";
-import { PersistOAuthAccountMode, PersistOAuthAccountParams, persistOAuthAccount } from "./persist-account.mjs";
-import { OAuthLinkPolicy, ResolveOAuthUserError, ResolveOAuthUserParams, ResolvedOAuthUser, applyUpdateUserInfoOnLink, canLinkImplicitly, resolveOAuthUser } from "./resolve-account.mjs";
-import { signInWithOAuthIdentity } from "./sign-in-with-oauth-identity.mjs";
-import { decryptOAuthToken, setTokenUtil } from "./token-encryption.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
 export * from "@better-auth/core/oauth2";
-export { GenerateStateOptions, OAuthLinkPolicy, PersistOAuthAccountMode, PersistOAuthAccountParams, ResolveOAuthUserError, ResolveOAuthUserParams, ResolvedOAuthUser, applyUpdateUserInfoOnLink, canLinkImplicitly, decryptOAuthToken, generateIdTokenNonce, generateState, parseState, persistOAuthAccount, resolveOAuthUser, setTokenUtil, signInWithOAuthIdentity };
+export { GenerateStateOptions, applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };

package/dist/oauth2/index.mjs

@@ -1,7 +1,5 @@
-import { decryptOAuthToken, setTokenUtil } from "./token-encryption.mjs";
-import { persistOAuthAccount } from "./persist-account.mjs";
-import { applyUpdateUserInfoOnLink, canLinkImplicitly, resolveOAuthUser } from "./resolve-account.mjs";
+import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./state.mjs";
-import { signInWithOAuthIdentity } from "./sign-in-with-oauth-identity.mjs";
 export * from "@better-auth/core/oauth2";
-export { applyUpdateUserInfoOnLink, canLinkImplicitly, decryptOAuthToken, generateIdTokenNonce, generateState, parseState, persistOAuthAccount, resolveOAuthUser, setTokenUtil, signInWithOAuthIdentity };
+export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };

package/dist/oauth2/link-account.d.mts

@@ -0,0 +1,74 @@
+import { Account, User } from "../types/models.mjs";
+import { GenericEndpointContext, UserProvisioningSource } from "@better-auth/core";
+
+//#region src/oauth2/link-account.d.ts
+declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
+  userInfo: Omit<User, "createdAt" | "updatedAt">;
+  account: Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+  callbackURL?: string | undefined;
+  disableSignUp?: boolean | undefined;
+  overrideUserInfo?: boolean | undefined;
+  isTrustedProvider?: boolean | undefined;
+  trustProviderByName?: boolean | undefined;
+  source?: UserProvisioningSource | undefined;
+}): Promise<{
+  error: string;
+  data: null;
+  isRegister?: undefined;
+} | {
+  error: string;
+  data: null;
+  isRegister: boolean;
+} | {
+  data: {
+    session: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      userId: string;
+      expiresAt: Date;
+      token: string;
+      ipAddress?: string | null | undefined;
+      userAgent?: string | null | undefined;
+    };
+    user: {
+      id: string;
+      createdAt: Date;
+      updatedAt: Date;
+      email: string;
+      emailVerified: boolean;
+      name: string;
+      image?: string | null | undefined;
+    };
+  };
+  error: null;
+  isRegister: boolean;
+}>;
+/**
+ * Provider profile a freshly linked account may copy onto the local user.
+ * `id` is the provider's account id (never the local user id), and `email`/
+ * `emailVerified` are identity anchors; all three are stripped before the
+ * remaining fields are written.
+ */
+type LinkedProviderProfile = {
+  id: string | number;
+  name?: string | undefined;
+  email?: string | null | undefined;
+  emailVerified?: boolean | undefined;
+  image?: string | null | undefined;
+};
+/**
+ * Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
+ * copy the freshly linked provider's profile onto the local user, matching the
+ * field set persisted on sign-up. The local `email` and `emailVerified` are
+ * never changed, so a link can't rebind the account's identity, and
+ * `updateUser` drops `undefined` fields, so a provider that omits one leaves
+ * the existing column intact.
+ *
+ * Returns the updated user so a caller that issues a session can seed the
+ * cookie cache with the fresh row. Returns `undefined` when the policy is
+ * disabled or the update fails: a failed profile sync must not abort the link.
+ */
+declare function applyUpdateUserInfoOnLink(c: GenericEndpointContext, userId: string, userInfo: LinkedProviderProfile): Promise<User | undefined>;
+//#endregion
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };

package/dist/oauth2/link-account.mjs

@@ -0,0 +1,222 @@
+import { isAPIError } from "../utils/is-api-error.mjs";
+import { setAccountCookie } from "../cookies/session-store.mjs";
+import { assertValidUserInfo } from "../utils/validate-user-info.mjs";
+import { OAUTH_CALLBACK_ERROR_CODES, redirectOnError } from "./errors.mjs";
+import { setTokenUtil } from "./utils.mjs";
+import { createEmailVerificationToken } from "../api/routes/email-verification.mjs";
+import { runWithTransaction } from "@better-auth/core/context";
+import { isDevelopment, logger } from "@better-auth/core/env";
+//#region src/oauth2/link-account.ts
+async function handleOAuthUserInfo(c, opts) {
+	const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
+	const source = opts.source ?? {
+		method: "oauth",
+		oauth: { providerId: account.providerId }
+	};
+	const dbUser = await c.context.internalAdapter.findOAuthUser(userInfo.email.toLowerCase(), account.accountId, account.providerId).catch((e) => {
+		logger.error("Better auth was unable to query your database.\nError: ", e);
+		redirectOnError(c, c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`, "internal_server_error");
+	});
+	let user = dbUser?.user;
+	const isRegister = !user;
+	if (dbUser) {
+		const linkedAccount = dbUser.linkedAccount ?? dbUser.accounts.find((acc) => acc.providerId === account.providerId && acc.accountId === account.accountId);
+		if (!linkedAccount) {
+			const accountLinking = c.context.options.account?.accountLinking;
+			const isTrustedProvider = opts.isTrustedProvider || opts.trustProviderByName !== false && c.context.trustedProviders.includes(account.providerId);
+			const requireLocalEmailVerified = accountLinking?.requireLocalEmailVerified ?? true;
+			if (!isTrustedProvider && !userInfo.emailVerified || requireLocalEmailVerified && !dbUser.user.emailVerified || accountLinking?.enabled === false || accountLinking?.disableImplicitLinking === true) {
+				if (isDevelopment()) logger.warn(`User already exist but account isn't linked to ${account.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`);
+				return {
+					error: "account not linked",
+					data: null
+				};
+			}
+			try {
+				const { id: _providerAccountId, ...providerUserInfo } = userInfo;
+				await assertValidUserInfo(c, {
+					user: {
+						...providerUserInfo,
+						id: dbUser.user.id,
+						email: userInfo.email.toLowerCase()
+					},
+					source: {
+						...source,
+						action: "link-account"
+					}
+				});
+				await c.context.internalAdapter.linkAccount({
+					providerId: account.providerId,
+					accountId: userInfo.id.toString(),
+					userId: dbUser.user.id,
+					accessToken: await setTokenUtil(account.accessToken, c.context),
+					refreshToken: await setTokenUtil(account.refreshToken, c.context),
+					idToken: account.idToken,
+					accessTokenExpiresAt: account.accessTokenExpiresAt,
+					refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+					scope: account.scope
+				});
+			} catch (e) {
+				if (isAPIError(e)) throw e;
+				logger.error("Unable to link account", e);
+				return {
+					error: "unable to link account",
+					data: null
+				};
+			}
+			if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
+			user = await applyUpdateUserInfoOnLink(c, dbUser.user.id, userInfo) ?? user;
+		} else {
+			const { id: _providerAccountId, ...providerUserInfo } = userInfo;
+			await assertValidUserInfo(c, {
+				user: {
+					...providerUserInfo,
+					id: dbUser.user.id,
+					email: userInfo.email.toLowerCase()
+				},
+				source: {
+					...source,
+					action: "sign-in"
+				}
+			});
+			/**
+			* `scope` intentionally omitted. Updated only via linkSocial.
+			*
+			* @see {@link Account.scope}
+			*/
+			const freshTokens = c.context.options.account?.updateAccountOnSignIn !== false ? Object.fromEntries(Object.entries({
+				idToken: account.idToken,
+				accessToken: await setTokenUtil(account.accessToken, c.context),
+				refreshToken: await setTokenUtil(account.refreshToken, c.context),
+				accessTokenExpiresAt: account.accessTokenExpiresAt,
+				refreshTokenExpiresAt: account.refreshTokenExpiresAt
+			}).filter(([_, value]) => value !== void 0)) : {};
+			if (c.context.options.account?.storeAccountCookie) await setAccountCookie(c, {
+				...linkedAccount,
+				...freshTokens
+			});
+			if (Object.keys(freshTokens).length > 0) await c.context.internalAdapter.updateAccount(linkedAccount.id, freshTokens);
+			if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
+		}
+		if (overrideUserInfo) {
+			const { id: _, ...restUserInfo } = userInfo;
+			const updatedUser = await c.context.internalAdapter.updateUser(dbUser.user.id, {
+				...restUserInfo,
+				email: userInfo.email.toLowerCase(),
+				emailVerified: userInfo.email.toLowerCase() === dbUser.user.email ? dbUser.user.emailVerified || userInfo.emailVerified : userInfo.emailVerified
+			});
+			if (updatedUser == null) logger.warn("Could not update user info during OAuth sign in; preserving existing user for session.");
+			user = updatedUser ?? user;
+		}
+	} else {
+		if (disableSignUp) return {
+			error: "signup disabled",
+			data: null,
+			isRegister: false
+		};
+		try {
+			const { id: _, ...restUserInfo } = userInfo;
+			const accountData = {
+				accessToken: await setTokenUtil(account.accessToken, c.context),
+				refreshToken: await setTokenUtil(account.refreshToken, c.context),
+				idToken: account.idToken,
+				accessTokenExpiresAt: account.accessTokenExpiresAt,
+				refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+				scope: account.scope,
+				providerId: account.providerId,
+				accountId: userInfo.id.toString()
+			};
+			const { createdUser, createdAccount } = await runWithTransaction(c.context.adapter, async () => {
+				const createdUser = await c.context.internalAdapter.createUser({
+					...restUserInfo,
+					email: userInfo.email.toLowerCase()
+				}, source);
+				return {
+					createdUser,
+					createdAccount: await c.context.internalAdapter.createAccount({
+						...accountData,
+						userId: createdUser.id
+					})
+				};
+			});
+			user = createdUser;
+			if (c.context.options.account?.storeAccountCookie) await setAccountCookie(c, createdAccount);
+		} catch (e) {
+			if (isAPIError(e)) throw e;
+			logger.error("Unable to create OAuth user", e);
+			return {
+				error: "unable to create user",
+				data: null,
+				isRegister: false
+			};
+		}
+	}
+	if (!user) return {
+		error: "unable to create user",
+		data: null,
+		isRegister: false
+	};
+	const requireEmailVerification = c.context.socialProviders.find((p) => p.id === account.providerId)?.options?.requireEmailVerification;
+	if (isRegister && !user.emailVerified && (c.context.options.emailVerification?.sendOnSignUp ?? requireEmailVerification)) await dispatchVerificationEmail(c, user, callbackURL);
+	if (requireEmailVerification && !user.emailVerified) {
+		if (!isRegister && c.context.options.emailVerification?.sendOnSignIn) await dispatchVerificationEmail(c, user, callbackURL);
+		return {
+			error: OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_VERIFIED,
+			data: null,
+			isRegister
+		};
+	}
+	const session = await c.context.internalAdapter.createSession(user.id);
+	if (!session) return {
+		error: "unable to create session",
+		data: null,
+		isRegister: false
+	};
+	return {
+		data: {
+			session,
+			user
+		},
+		error: null,
+		isRegister
+	};
+}
+async function dispatchVerificationEmail(c, user, callbackURL) {
+	const sendVerificationEmail = c.context.options.emailVerification?.sendVerificationEmail;
+	if (!sendVerificationEmail) return;
+	try {
+		const token = await createEmailVerificationToken(c.context.secret, user.email, void 0, c.context.options.emailVerification?.expiresIn);
+		const url = `${c.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(callbackURL || "/")}`;
+		await c.context.runInBackgroundOrAwait(sendVerificationEmail({
+			user,
+			url,
+			token
+		}, c.request));
+	} catch (e) {
+		c.context.logger.error("Failed to send OAuth verification email", e);
+	}
+}
+/**
+* Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
+* copy the freshly linked provider's profile onto the local user, matching the
+* field set persisted on sign-up. The local `email` and `emailVerified` are
+* never changed, so a link can't rebind the account's identity, and
+* `updateUser` drops `undefined` fields, so a provider that omits one leaves
+* the existing column intact.
+*
+* Returns the updated user so a caller that issues a session can seed the
+* cookie cache with the fresh row. Returns `undefined` when the policy is
+* disabled or the update fails: a failed profile sync must not abort the link.
+*/
+async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
+	if (c.context.options.account?.accountLinking?.updateUserInfoOnLink !== true) return;
+	const { id: _id, email: _email, emailVerified: _emailVerified, ...profile } = userInfo;
+	try {
+		return await c.context.internalAdapter.updateUser(userId, profile);
+	} catch (e) {
+		c.context.logger.warn("Could not update user info on account link", e);
+		return;
+	}
+}
+//#endregion
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };

package/dist/oauth2/state.d.mts

@@ -14,14 +14,6 @@ declare function generateIdTokenNonce(provider: {
 /**
  * Inputs for {@link generateState}. Grouped into one object so call sites read
  * by name instead of by position.
- *
- * `requestedScopes` is the effective scope set encoded in the authorization
- * URL, persisted into OAuth state so the callback can fall back to the request
- * when the provider omits `scope` from its token response (RFC 6749 §5.1).
- * Because that set is only known after `createAuthorizationURL` runs, the
- * redirect-initiating routes build the URL first, then pass the URL's `state`
- * and `codeVerifier` here so state is still written exactly once. Flows that do
- * not need the URL first (e.g. SSO) omit both and let fresh values be minted.
  */
 interface GenerateStateOptions {
   /** Link target when this flow links a provider identity to an existing user. */
@@ -31,8 +23,6 @@ interface GenerateStateOptions {
   } | undefined;
   /** Extra data to round-trip through state; `false` writes none. */
   additionalData?: Record<string, any> | false | undefined;
-  /** The effective scopes encoded in the authorization URL (the §5.1 fallback). */
-  requestedScopes?: string[] | undefined;
   /** The `state` nonce already used to build the authorization URL. Minted when omitted. */
   state?: string | undefined;
   /** The PKCE `codeVerifier` already used to build the authorization URL. Minted when omitted. */
@@ -58,7 +48,6 @@ declare function parseState(c: GenericEndpointContext): Promise<{
   } | undefined;
   requestSignUp?: boolean | undefined;
   idTokenNonce?: string | undefined;
-  requestedScopes?: string[] | undefined;
   serverContext?: Record<string, unknown> | undefined;
 }>;
 //#endregion

package/dist/oauth2/state.mjs

@@ -30,12 +30,11 @@ async function generateState(c, options) {
 		serverContext,
 		expiresAt: Date.now() + 600 * 1e3,
 		requestSignUp: c.body?.requestSignUp,
-		requestedScopes: options?.requestedScopes,
 		idTokenNonce: options?.idTokenNonce
 	};
 	await setOAuthState(stateData);
 	try {
-		return generateGenericState(c, stateData, { oauthState: options?.state });
+		return generateGenericState(c, stateData);
 	} catch (error) {
 		c.context.logger.error("Failed to create verification", error);
 		throw new APIError("INTERNAL_SERVER_ERROR", {

package/dist/oauth2/utils.d.mts

@@ -0,0 +1,11 @@
+import { AuthContext, LiteralString } from "@better-auth/core";
+
+//#region src/oauth2/utils.d.ts
+declare function decryptOAuthToken(token: string, ctx: AuthContext): string | Promise<string>;
+declare function setTokenUtil(token: string | null | undefined, ctx: AuthContext): string | Promise<string> | null | undefined;
+declare function getOAuthCallbackPath(provider: {
+  id: LiteralString;
+  callbackPath?: string | undefined;
+}): string;
+//#endregion
+export { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil };

package/dist/oauth2/{token-encryption.mjs → utils.mjs}

@@ -1,5 +1,5 @@
 import { symmetricDecrypt, symmetricEncrypt } from "../crypto/index.mjs";
-//#region src/oauth2/token-encryption.ts
+//#region src/oauth2/utils.ts
 /**
 * Check if a string looks like encrypted data
 */
@@ -25,5 +25,9 @@ function setTokenUtil(token, ctx) {
 	});
 	return token;
 }
+function getOAuthCallbackPath(provider) {
+	if (!provider.callbackPath) return `/callback/${provider.id}`;
+	return provider.callbackPath.startsWith("/") ? provider.callbackPath : `/${provider.callbackPath}`;
+}
 //#endregion
-export { decryptOAuthToken, setTokenUtil };
+export { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil };

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.0-beta.7";
+var version = "1.7.0-beta.9";
 //#endregion
 export { version };

package/dist/plugins/generic-oauth/index.d.mts

@@ -10,7 +10,7 @@ import { PatreonOptions, patreon } from "./providers/patreon.mjs";
 import { SlackOptions, slack } from "./providers/slack.mjs";
 import { AuthContext } from "@better-auth/core";
 import * as _better_auth_core_oauth20 from "@better-auth/core/oauth2";
-import { UpstreamProvider } from "@better-auth/core/oauth2";
+import { OAuthProvider } from "@better-auth/core/oauth2";
 import * as _better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
 
 //#region src/plugins/generic-oauth/index.d.ts
@@ -38,7 +38,7 @@ declare const genericOAuth: <const ID extends string>(options: GenericOAuthOptio
   version: string;
   init: (ctx: AuthContext) => Promise<{
     context: {
-      socialProviders: UpstreamProvider<Record<string, any>, Partial<_better_auth_core_oauth20.ProviderOptions<any>>>[];
+      socialProviders: OAuthProvider<Record<string, any>, Partial<_better_auth_core_oauth20.ProviderOptions<any>>>[];
     };
   }>;
   options: GenericOAuthOptions<ID>;

package/dist/plugins/generic-oauth/index.mjs

@@ -122,7 +122,6 @@ const genericOAuth = (options) => {
 				const provider = {
 					id: c.providerId,
 					name: c.name ?? c.providerId,
-					callbackPath: `/callback/${c.providerId}`,
 					issuer,
 					idToken: idTokenConfig,
 					requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,

package/dist/plugins/oauth-popup/index.mjs

@@ -152,13 +152,13 @@ const oauthPopupStart = createAuthEndpoint("/oauth-popup/start", {
 			popupOrigin,
 			popupNonce: c.query.popupNonce ?? ""
 		}), c.context.secret, marker.attributes);
-		({url} = await provider.createAuthorizationURL({
+		url = await provider.createAuthorizationURL({
 			state,
 			codeVerifier,
 			idTokenNonce,
 			redirectURI: `${c.context.baseURL}/callback/${provider.id}`,
 			scopes: c.query.scopes ? c.query.scopes.split(",") : void 0
-		}));
+		});
 	} catch (error) {
 		c.context.logger.error("OAuth popup failed to start", error);
 		return fail("popup_sign_in_failed", "Failed to start the OAuth flow.");