better-auth 1.7.0-beta.8 → 1.7.0-rc.0

package/dist/api/index.d.mts

@@ -1,6 +1,5 @@
 import { OverrideMerge, Prettify as Prettify$1, UnionToIntersection } from "../types/helper.mjs";
 import { AdditionalSessionFieldsInput, AdditionalUserFieldsInput } from "../types/models.mjs";
-import { getIp } from "../utils/get-request-ip.mjs";
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { DispatchContext, dispatchAuthEndpoint } from "./dispatch.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
@@ -11,7 +10,7 @@ import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEm
 import { error } from "./routes/error.mjs";
 import { ok } from "./routes/ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./routes/password.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { signInEmail, signInSocial } from "./routes/sign-in.mjs";
 import { signOut } from "./routes/sign-out.mjs";
 import { signUpEmail } from "./routes/sign-up.mjs";
@@ -24,6 +23,7 @@ import * as _better_auth_core_db0 from "@better-auth/core/db";
 import { InternalLogger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import * as _better_auth_core_oauth20 from "@better-auth/core/oauth2";
+import { getIP } from "@better-auth/core/utils/ip";
 import * as better_call0 from "better-call";
 import { AuthEndpoint, AuthMiddleware, NO_STORE_HEADERS, createAuthEndpoint, createAuthMiddleware, optionsMiddleware } from "@better-auth/core/api";
 import * as zod from "zod";
@@ -3971,4 +3971,4 @@ declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext, optio
   } extends infer T_2 ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K] } : never) & T_1> : never : never : never;
 };
 //#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -1,11 +1,10 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
-import { getIp } from "../utils/get-request-ip.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
 import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
@@ -21,6 +20,7 @@ import { dispatchAuthEndpoint } from "./dispatch.mjs";
 import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
 import { logger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
+import { getIP } from "@better-auth/core/utils/ip";
 import { ATTR_CONTEXT, ATTR_HOOK_TYPE, ATTR_HTTP_RESPONSE_STATUS_CODE, ATTR_HTTP_ROUTE, withSpan } from "@better-auth/core/instrumentation";
 import { normalizePathname } from "@better-auth/core/utils/url";
 import { createRouter } from "better-call";
@@ -165,6 +165,8 @@ const router = (ctx, options) => {
 			const normalizedPath = normalizePathname(req.url, basePath);
 			if (disabledPaths.includes(normalizedPath)) return new Response("Not Found", { status: 404 });
 			let currentRequest = req;
+			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
+			if (rateLimitResponse) return rateLimitResponse;
 			for (const plugin of ctx.options.plugins || []) if (plugin.onRequest) {
 				const response = await withSpan(`onRequest ${plugin.id}`, {
 					[ATTR_HOOK_TYPE]: "onRequest",
@@ -173,8 +175,6 @@ const router = (ctx, options) => {
 				if (response && "response" in response) return response.response;
 				if (response && "request" in response) currentRequest = response.request;
 			}
-			const rateLimitResponse = await onRequestRateLimit(currentRequest, ctx);
-			if (rateLimitResponse) return rateLimitResponse;
 			return currentRequest;
 		},
 		async onResponse(res, req) {
@@ -213,4 +213,4 @@ const router = (ctx, options) => {
 	});
 };
 //#endregion
-export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getEndpoints, getIp, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/rate-limiter/index.mjs

@@ -1,8 +1,7 @@
 import { wildcardMatch } from "../../utils/wildcard.mjs";
-import { getIp } from "../../utils/get-request-ip.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
+import { createRateLimitKey, getIP } from "@better-auth/core/utils/ip";
 import { normalizePathname } from "@better-auth/core/utils/url";
-import { createRateLimitKey } from "@better-auth/core/utils/ip";
 //#region src/api/rate-limiter/index.ts
 const memory = /* @__PURE__ */ new Map();
 const MEMORY_STORE_MAX_ENTRIES = 1e5;
@@ -237,10 +236,10 @@ async function resolveRateLimitConfig(req, ctx) {
 	const path = normalizePathname(req.url, basePath);
 	let currentWindow = ctx.rateLimit.window;
 	let currentMax = ctx.rateLimit.max;
-	const ip = getIp(req, ctx.options);
+	const ip = getIP(req, ctx.options);
 	if (!ip && ctx.options.advanced?.ipAddress?.disableIpTracking) return null;
 	if (!ip && !ipWarningLogged) {
-		ctx.logger.warn("Rate limiting could not determine a client IP and is falling back to a single shared per-path bucket. Ensure your runtime forwards a trusted client IP header and configure `advanced.ipAddress.ipAddressHeaders` if needed.");
+		ctx.logger.warn("Rate limiting could not determine a client IP and is falling back to a single shared per-path bucket. Ensure your runtime forwards a trusted client IP header, then set `advanced.ipAddress.ipAddressHeaders` or `advanced.ipAddress.trustedProxies` so the address can be resolved.");
 		ipWarningLogged = true;
 	}
 	const key = createRateLimitKey(ip ?? NO_TRUSTED_IP_KEY, path);

package/dist/api/routes/index.d.mts

@@ -4,7 +4,7 @@ import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEm
 import { error } from "./error.mjs";
 import { ok } from "./ok.mjs";
 import { requestPasswordReset, requestPasswordResetCallback, resetPassword, verifyPassword } from "./password.mjs";
-import { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
+import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
 import { signInEmail, signInSocial } from "./sign-in.mjs";
 import { signOut } from "./sign-out.mjs";
 import { signUpEmail } from "./sign-up.mjs";

package/dist/api/routes/session.d.mts

@@ -63,6 +63,34 @@ declare const getSessionFromCtx: <U extends Record<string, any> = Record<string,
   session: S & Session$1;
   user: U & User$1;
 } | null>;
+/**
+ * Reads the session from the source that can authorize sensitive work.
+ *
+ * Stateful deployments must re-read the server-side session store because an
+ * earlier hook may have populated `ctx.context.session` from cookie cache.
+ * Stateless deployments keep the signed cookie as the session record.
+ */
+declare const getAuthoritativeSessionFromCtx: <U extends Record<string, any> = Record<string, any>, S extends Record<string, any> = Record<string, any>>(ctx: GenericEndpointContext) => Promise<{
+  session: S & {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null | undefined;
+    userAgent?: string | null | undefined;
+  };
+  user: U & {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null | undefined;
+  };
+} | null>;
 /**
  * The middleware forces the endpoint to require a valid session.
  */
@@ -90,9 +118,8 @@ declare const sessionMiddleware: (inputContext: better_call0.MiddlewareInputCont
   };
 }>;
 /**
- * This middleware forces the endpoint to require a valid session and ignores cookie cache.
+ * This middleware forces the endpoint to require a valid authoritative session.
  * This should be used for sensitive operations like password changes, account deletion, etc.
- * to ensure that revoked sessions cannot be used even if they're still cached in cookies.
  */
 declare const sensitiveSessionMiddleware: (inputContext: better_call0.MiddlewareInputContext<better_call0.MiddlewareOptions>) => Promise<{
   session: {
@@ -420,4 +447,4 @@ declare const revokeOtherSessions: better_call0.StrictEndpoint<"/revoke-other-se
   status: boolean;
 }>;
 //#endregion
-export { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };
+export { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };

package/dist/api/routes/session.mjs

@@ -240,7 +240,7 @@ const getSession = () => createAuthEndpoint("/get-session", {
 				deleteSessionCookie(ctx);
 				throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_SESSION);
 			}
-			const maxAge = (updatedSession.expiresAt.valueOf() - Date.now()) / 1e3;
+			const maxAge = ctx.context.sessionConfig.expiresIn;
 			await setSessionCookie(ctx, {
 				session: updatedSession,
 				user: session.user
@@ -307,6 +307,18 @@ const getSessionFromCtx = async (ctx, config) => {
 	return session.response;
 };
 /**
+* Reads the session from the source that can authorize sensitive work.
+*
+* Stateful deployments must re-read the server-side session store because an
+* earlier hook may have populated `ctx.context.session` from cookie cache.
+* Stateless deployments keep the signed cookie as the session record.
+*/
+const getAuthoritativeSessionFromCtx = async (ctx) => {
+	if (!isStateful(ctx)) return getSessionFromCtx(ctx);
+	ctx.context.session = null;
+	return getSessionFromCtx(ctx, { disableCookieCache: true });
+};
+/**
 * The middleware forces the endpoint to require a valid session.
 */
 const sessionMiddleware = createAuthMiddleware(async (ctx) => {
@@ -318,12 +330,11 @@ const sessionMiddleware = createAuthMiddleware(async (ctx) => {
 	return { session };
 });
 /**
-* This middleware forces the endpoint to require a valid session and ignores cookie cache.
+* This middleware forces the endpoint to require a valid authoritative session.
 * This should be used for sensitive operations like password changes, account deletion, etc.
-* to ensure that revoked sessions cannot be used even if they're still cached in cookies.
 */
 const sensitiveSessionMiddleware = createAuthMiddleware(async (ctx) => {
-	const session = await getSessionFromCtx(ctx, { disableCookieCache: true });
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session?.session) throw APIError.from("UNAUTHORIZED", {
 		message: "Unauthorized",
 		code: "UNAUTHORIZED"
@@ -499,4 +510,4 @@ const revokeOtherSessions = createAuthEndpoint("/revoke-other-sessions", {
 	return ctx.json({ status: true });
 });
 //#endregion
-export { freshSessionMiddleware, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };
+export { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware };

package/dist/context/create-context.mjs

@@ -17,6 +17,7 @@ import { createLogger, env, isProduction, isTest } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { socialProviders } from "@better-auth/core/social-providers";
+import { findInvalidTrustedProxies } from "@better-auth/core/utils/ip";
 import { createTelemetry } from "@better-auth/telemetry";
 import defu$1 from "defu";
 //#region src/context/create-context.ts
@@ -87,6 +88,11 @@ Most of the features of Better Auth will not work correctly.`);
 		plugins: plugins.concat(internalPlugins)
 	};
 	checkEndpointConflicts(options, logger);
+	const trustedProxies = options.advanced?.ipAddress?.trustedProxies;
+	if (trustedProxies && trustedProxies.length > 0) {
+		const invalid = findInvalidTrustedProxies(trustedProxies);
+		if (invalid.length > 0) logger.warn(`Ignoring invalid \`advanced.ipAddress.trustedProxies\` entries: ${invalid.join(", ")}. Each entry must be an IP address or CIDR range.`);
+	}
 	const cookies = getCookies(options);
 	const tables = getAuthTables(options);
 	const providers = (await Promise.all(Object.entries(options.socialProviders || {}).map(async ([key, originalConfig]) => {

package/dist/db/get-migration.mjs

@@ -148,6 +148,7 @@ async function getMigrations(config) {
 	const toBeCreated = [];
 	const toBeAdded = [];
 	for (const [key, value] of Object.entries(betterAuthSchema)) {
+		if (value.disableMigrations) continue;
 		const table = tableMetadata.find((t) => t.name === key);
 		if (!table) {
 			const tIndex = toBeCreated.findIndex((t) => t.table === key);

package/dist/db/get-schema.d.mts

@@ -5,6 +5,7 @@ import { DBFieldAttribute } from "@better-auth/core/db";
 declare function getSchema(config: BetterAuthOptions): Record<string, {
   fields: Record<string, DBFieldAttribute>;
   order: number;
+  disableMigrations?: boolean | undefined;
 }>;
 //#endregion
 export { getSchema };

package/dist/db/get-schema.mjs

@@ -23,11 +23,13 @@ function getSchema(config) {
 				...schema[table.modelName].fields,
 				...actualFields
 			};
+			if (table.disableMigrations) schema[table.modelName].disableMigrations = true;
 			continue;
 		}
 		schema[table.modelName] = {
 			fields: actualFields,
-			order: table.order || Infinity
+			order: table.order || Infinity,
+			disableMigrations: table.disableMigrations
 		};
 	}
 	return schema;

package/dist/db/index.d.mts

@@ -3,7 +3,8 @@ import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getSchema } from "./get-schema.mjs";
 import { DatabaseHooksEntry, getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
-import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
+import { revokeUnprovenAccountAccess } from "./revoke-unproven-account-access.mjs";
+import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
 import { FieldAttributeToSchema, toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
-export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { DatabaseHooksEntry, FieldAttributeToObject, FieldAttributeToSchema, InferAdditionalFieldsFromPluginOptions, InferFieldsInputClient, InferFieldsOutput, RemoveFieldsWithReturnedFalse, buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, revokeUnprovenAccountAccess, toZodSchema };

package/dist/db/index.mjs

@@ -1,9 +1,10 @@
 import { __exportAll, __reExport } from "../_virtual/_rolldown/runtime.mjs";
 import { getSchema } from "./get-schema.mjs";
-import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
+import { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput } from "./schema.mjs";
 import { convertFromDB, convertToDB } from "./field-converter.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
 import { createInternalAdapter } from "./internal-adapter.mjs";
+import { revokeUnprovenAccountAccess } from "./revoke-unproven-account-access.mjs";
 import { toZodSchema } from "./to-zod.mjs";
 export * from "@better-auth/core/db";
 //#region src/db/index.ts
@@ -19,14 +20,16 @@ var db_exports = /* @__PURE__ */ __exportAll({
 	parseAccountInput: () => parseAccountInput,
 	parseAccountOutput: () => parseAccountOutput,
 	parseAdditionalUserInput: () => parseAdditionalUserInput,
+	parseAdditionalUserInputFromProviderProfile: () => parseAdditionalUserInputFromProviderProfile,
 	parseInputData: () => parseInputData,
 	parseSessionInput: () => parseSessionInput,
 	parseSessionOutput: () => parseSessionOutput,
 	parseUserInput: () => parseUserInput,
 	parseUserOutput: () => parseUserOutput,
+	revokeUnprovenAccountAccess: () => revokeUnprovenAccountAccess,
 	toZodSchema: () => toZodSchema
 });
 import * as import__better_auth_core_db from "@better-auth/core/db";
 __reExport(db_exports, import__better_auth_core_db);
 //#endregion
-export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, toZodSchema };
+export { buildSyntheticUserOutput, convertFromDB, convertToDB, createInternalAdapter, db_exports, getSchema, getSessionDefaultFields, getWithHooks, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput, revokeUnprovenAccountAccess, toZodSchema };

package/dist/db/internal-adapter.mjs

@@ -1,4 +1,3 @@
-import { getIp } from "../utils/get-request-ip.mjs";
 import { getSessionDefaultFields, parseSessionOutput, parseUserOutput } from "./schema.mjs";
 import { getDate } from "../utils/date.mjs";
 import { assertValidUserInfo, assertValidUserInfoSource } from "../utils/validate-user-info.mjs";
@@ -8,6 +7,7 @@ import { getCurrentAdapter, getCurrentAuthContext, runWithTransaction } from "@b
 import { APIError, BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { getIP } from "@better-auth/core/utils/ip";
 import { base64Url } from "@better-auth/utils/base64";
 import { createHash } from "@better-auth/utils/hash";
 //#region src/db/internal-adapter.ts
@@ -230,7 +230,7 @@ const createInternalAdapter = (adapter, ctx) => {
 			const defaultAdditionalFields = getSessionDefaultFields(options);
 			const data = {
 				...sessionId ? { id: sessionId } : {},
-				ipAddress: headers ? getIp(headers, options) || "" : "",
+				ipAddress: headers ? getIP(headers, options) || "" : "",
 				userAgent: headers?.get("user-agent") || "",
 				...rest,
 				expiresAt: dontRememberMe ? getDate(3600 * 24, "sec") : getDate(sessionExpiration, "sec"),

package/dist/db/revoke-unproven-account-access.d.mts

@@ -0,0 +1,21 @@
+import { User } from "../types/models.mjs";
+import { GenericEndpointContext } from "@better-auth/core";
+
+//#region src/db/revoke-unproven-account-access.d.ts
+/**
+ * Strip every account link and session a pre-existing account accrued before
+ * control of its email was proven.
+ *
+ * An `emailVerified: false` row carries no proof that linked access belongs
+ * to the mailbox owner. When an email-primary proof (magic link, email OTP)
+ * resolves to such a row, deleting accounts and revoking standing sessions
+ * makes the verified owner inherit no password, OAuth link, or session that
+ * predates the proof. This helper also flips `emailVerified` after cleanup and
+ * returns the current user for the caller to use when minting the owner's
+ * session.
+ *
+ * @param userId - The pre-existing, not-yet-verified user being promoted.
+ */
+declare function revokeUnprovenAccountAccess(ctx: GenericEndpointContext, userId: string): Promise<User | null>;
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/db/revoke-unproven-account-access.mjs

@@ -0,0 +1,58 @@
+import { BetterAuthError } from "@better-auth/core/error";
+//#region src/db/revoke-unproven-account-access.ts
+const cleanupLockExpiresInMs = 5e3;
+const cleanupLockWaitMs = 2e3;
+const cleanupLockPollMs = 250;
+const cleanupLockIdentifier = (userId) => `revoke-unproven-account-access:${userId}`;
+async function waitForCleanupLock(ctx, identifier) {
+	const deadline = Date.now() + cleanupLockWaitMs;
+	while (Date.now() < deadline) {
+		const lock = await ctx.context.internalAdapter.findVerificationValue(identifier);
+		if (!lock) return;
+		if (lock.expiresAt <= /* @__PURE__ */ new Date()) {
+			await ctx.context.internalAdapter.deleteVerificationByIdentifier(identifier);
+			return;
+		}
+		await new Promise((resolve) => setTimeout(resolve, cleanupLockPollMs));
+	}
+}
+/**
+* Strip every account link and session a pre-existing account accrued before
+* control of its email was proven.
+*
+* An `emailVerified: false` row carries no proof that linked access belongs
+* to the mailbox owner. When an email-primary proof (magic link, email OTP)
+* resolves to such a row, deleting accounts and revoking standing sessions
+* makes the verified owner inherit no password, OAuth link, or session that
+* predates the proof. This helper also flips `emailVerified` after cleanup and
+* returns the current user for the caller to use when minting the owner's
+* session.
+*
+* @param userId - The pre-existing, not-yet-verified user being promoted.
+*/
+async function revokeUnprovenAccountAccess(ctx, userId) {
+	const lockIdentifier = cleanupLockIdentifier(userId);
+	if (!await ctx.context.internalAdapter.reserveVerificationValue({
+		identifier: lockIdentifier,
+		value: userId,
+		expiresAt: new Date(Date.now() + cleanupLockExpiresInMs)
+	}).catch((error) => {
+		if (error instanceof BetterAuthError && error.message.includes("requires database-backed verification storage")) return true;
+		throw error;
+	})) {
+		await waitForCleanupLock(ctx, lockIdentifier);
+		return ctx.context.internalAdapter.findUserById(userId);
+	}
+	try {
+		const user = await ctx.context.internalAdapter.findUserById(userId);
+		if (!user || user.emailVerified) return user;
+		const accounts = await ctx.context.internalAdapter.findAccounts(userId);
+		for (const account of accounts) await ctx.context.internalAdapter.deleteAccount(account.id);
+		await ctx.context.internalAdapter.deleteUserSessions(userId);
+		return await ctx.context.internalAdapter.updateUser(userId, { emailVerified: true });
+	} finally {
+		await ctx.context.internalAdapter.deleteVerificationByIdentifier(lockIdentifier).catch(() => {});
+	}
+}
+//#endregion
+export { revokeUnprovenAccountAccess };

package/dist/db/schema.d.mts

@@ -24,6 +24,7 @@ declare function parseInputData<T extends Record<string, any>>(data: T, schema:
   action?: ("create" | "update") | undefined;
 }): Partial<T>;
 declare function parseUserInput(options: BetterAuthOptions, user: Record<string, any> | undefined, action: "create" | "update"): Partial<Record<string, any>>;
+declare function parseAdditionalUserInputFromProviderProfile(options: BetterAuthOptions, profile: Record<string, unknown> | undefined, action: "create" | "update"): Partial<Record<string, unknown>>;
 declare function parseAdditionalUserInput(options: BetterAuthOptions, user?: Record<string, any> | undefined): Partial<Record<string, any>>;
 declare function parseAccountInput(options: BetterAuthOptions, account: Partial<Account>): Partial<Partial<{
   id: string;
@@ -58,4 +59,4 @@ declare function mergeSchema<S extends BetterAuthPluginDBSchema>(schema: S, newS
   } | undefined;
 } | undefined } | undefined): S;
 //#endregion
-export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };
+export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/db/schema.mjs

@@ -113,6 +113,18 @@ function parseUserInput(options, user = {}, action) {
 		action
 	});
 }
+function parseAdditionalUserInputFromProviderProfile(options, profile = {}, action) {
+	const schema = getFields(options, "user", "input");
+	const allowedProfileFields = Object.create(null);
+	for (const key of Object.keys(profile)) {
+		if (schema[key]?.input === false) continue;
+		allowedProfileFields[key] = profile[key];
+	}
+	return parseInputData(allowedProfileFields, {
+		fields: schema,
+		action
+	});
+}
 function parseAdditionalUserInput(options, user) {
 	const schema = getFields(options, "user", "input");
 	return parseInputData(user || {}, { fields: schema });
@@ -146,4 +158,4 @@ function mergeSchema(schema, newSchema) {
 	return schema;
 }
 //#endregion
-export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };
+export { buildSyntheticUserOutput, getSessionDefaultFields, mergeSchema, parseAccountInput, parseAccountOutput, parseAdditionalUserInput, parseAdditionalUserInputFromProviderProfile, parseInputData, parseSessionInput, parseSessionOutput, parseUserInput, parseUserOutput };

package/dist/oauth2/link-account.mjs

@@ -1,11 +1,12 @@
 import { isAPIError } from "../utils/is-api-error.mjs";
+import { parseAdditionalUserInputFromProviderProfile } from "../db/schema.mjs";
 import { setAccountCookie } from "../cookies/session-store.mjs";
 import { assertValidUserInfo } from "../utils/validate-user-info.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, redirectOnError } from "./errors.mjs";
 import { setTokenUtil } from "./utils.mjs";
 import { createEmailVerificationToken } from "../api/routes/email-verification.mjs";
 import { runWithTransaction } from "@better-auth/core/context";
-import { isDevelopment, logger } from "@better-auth/core/env";
+import { isDevelopment } from "@better-auth/core/env";
 //#region src/oauth2/link-account.ts
 async function handleOAuthUserInfo(c, opts) {
 	const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
@@ -14,7 +15,7 @@ async function handleOAuthUserInfo(c, opts) {
 		oauth: { providerId: account.providerId }
 	};
 	const dbUser = await c.context.internalAdapter.findOAuthUser(userInfo.email.toLowerCase(), account.accountId, account.providerId).catch((e) => {
-		logger.error("Better auth was unable to query your database.\nError: ", e);
+		c.context.logger.error("Better auth was unable to query your database.\nError: ", e);
 		redirectOnError(c, c.context.options.onAPIError?.errorURL || `${c.context.baseURL}/error`, "internal_server_error");
 	});
 	let user = dbUser?.user;
@@ -26,7 +27,7 @@ async function handleOAuthUserInfo(c, opts) {
 			const isTrustedProvider = opts.isTrustedProvider || opts.trustProviderByName !== false && c.context.trustedProviders.includes(account.providerId);
 			const requireLocalEmailVerified = accountLinking?.requireLocalEmailVerified ?? true;
 			if (!isTrustedProvider && !userInfo.emailVerified || requireLocalEmailVerified && !dbUser.user.emailVerified || accountLinking?.enabled === false || accountLinking?.disableImplicitLinking === true) {
-				if (isDevelopment()) logger.warn(`User already exist but account isn't linked to ${account.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`);
+				if (isDevelopment()) c.context.logger.warn(`User already exist but account isn't linked to ${account.providerId}. To read more about how account linking works in Better Auth see https://www.better-auth.com/docs/concepts/users-accounts#account-linking.`);
 				return {
 					error: "account not linked",
 					data: null
@@ -58,7 +59,7 @@ async function handleOAuthUserInfo(c, opts) {
 				});
 			} catch (e) {
 				if (isAPIError(e)) throw e;
-				logger.error("Unable to link account", e);
+				c.context.logger.error("Unable to link account", e);
 				return {
 					error: "unable to link account",
 					data: null
@@ -99,13 +100,16 @@ async function handleOAuthUserInfo(c, opts) {
 			if (userInfo.emailVerified && !dbUser.user.emailVerified && userInfo.email.toLowerCase() === dbUser.user.email) await c.context.internalAdapter.updateUser(dbUser.user.id, { emailVerified: true });
 		}
 		if (overrideUserInfo) {
-			const { id: _, ...restUserInfo } = userInfo;
+			const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+			const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "update");
 			const updatedUser = await c.context.internalAdapter.updateUser(dbUser.user.id, {
-				...restUserInfo,
+				name,
+				image,
+				...additionalUserFields,
 				email: userInfo.email.toLowerCase(),
 				emailVerified: userInfo.email.toLowerCase() === dbUser.user.email ? dbUser.user.emailVerified || userInfo.emailVerified : userInfo.emailVerified
 			});
-			if (updatedUser == null) logger.warn("Could not update user info during OAuth sign in; preserving existing user for session.");
+			if (updatedUser == null) c.context.logger.warn("Could not update user info during OAuth sign in; preserving existing user for session.");
 			user = updatedUser ?? user;
 		}
 	} else {
@@ -115,7 +119,8 @@ async function handleOAuthUserInfo(c, opts) {
 			isRegister: false
 		};
 		try {
-			const { id: _, ...restUserInfo } = userInfo;
+			const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+			const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "create");
 			const accountData = {
 				accessToken: await setTokenUtil(account.accessToken, c.context),
 				refreshToken: await setTokenUtil(account.refreshToken, c.context),
@@ -128,8 +133,11 @@ async function handleOAuthUserInfo(c, opts) {
 			};
 			const { createdUser, createdAccount } = await runWithTransaction(c.context.adapter, async () => {
 				const createdUser = await c.context.internalAdapter.createUser({
-					...restUserInfo,
-					email: userInfo.email.toLowerCase()
+					name,
+					image,
+					...additionalUserFields,
+					email: userInfo.email.toLowerCase(),
+					emailVerified: userInfo.emailVerified
 				}, source);
 				return {
 					createdUser,
@@ -143,7 +151,7 @@ async function handleOAuthUserInfo(c, opts) {
 			if (c.context.options.account?.storeAccountCookie) await setAccountCookie(c, createdAccount);
 		} catch (e) {
 			if (isAPIError(e)) throw e;
-			logger.error("Unable to create OAuth user", e);
+			c.context.logger.error("Unable to create OAuth user", e);
 			return {
 				error: "unable to create user",
 				data: null,
@@ -210,9 +218,14 @@ async function dispatchVerificationEmail(c, user, callbackURL) {
 */
 async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
 	if (c.context.options.account?.accountLinking?.updateUserInfoOnLink !== true) return;
-	const { id: _id, email: _email, emailVerified: _emailVerified, ...profile } = userInfo;
 	try {
-		return await c.context.internalAdapter.updateUser(userId, profile);
+		const { id: _id, email: _email, emailVerified: _emailVerified, name, image, ...providerProfile } = userInfo;
+		const additionalUserFields = parseAdditionalUserInputFromProviderProfile(c.context.options, providerProfile, "update");
+		return await c.context.internalAdapter.updateUser(userId, {
+			name,
+			image,
+			...additionalUserFields
+		});
 	} catch (e) {
 		c.context.logger.warn("Could not update user info on account link", e);
 		return;

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.0-beta.8";
+var version = "1.7.0-rc.0";
 //#endregion
 export { version };

package/dist/plugins/admin/routes.mjs

@@ -1,7 +1,7 @@
 import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermission } from "./has-permission.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -14,7 +14,7 @@ import * as z from "zod";
 * Will also provide additional types on the user to include role types.
 */
 const adminMiddleware = createAuthMiddleware(async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) throw APIError.fromStatus("UNAUTHORIZED");
 	return { session };
 });
@@ -146,7 +146,7 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 		$Infer: { body: {} }
 	}
 }, async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session && (ctx.request || ctx.headers)) throw ctx.error("UNAUTHORIZED");
 	if (session) {
 		if (!hasPermission({
@@ -885,7 +885,7 @@ const userHasPermission = (opts) => {
 		}
 	}, async (ctx) => {
 		if (!ctx.body?.permissions) throw new APIError("BAD_REQUEST", { message: "invalid permission check. no permission(s) were passed." });
-		const session = await getSessionFromCtx(ctx);
+		const session = await getAuthoritativeSessionFromCtx(ctx);
 		if (!session && (ctx.request || ctx.headers)) throw new APIError("UNAUTHORIZED");
 		if (!session && !ctx.body.userId && !ctx.body.role) throw new APIError("BAD_REQUEST", { message: "user id or role is required" });
 		const user = session?.user || (ctx.body.role ? {