better-auth 1.7.0 → 1.7.2

package/dist/api/middlewares/origin-check.mjs

@@ -1,3 +1,4 @@
+import { getBaseURL, getOrigin } from "../../utils/url.mjs";
 import { matchesOriginPattern } from "../../auth/trusted-origins.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { normalizePathname } from "@better-auth/core/utils/url";
@@ -95,7 +96,8 @@ const originCheck = (getValue) => createAuthMiddleware(async (ctx) => {
 async function validateOrigin(ctx, forceValidate = false) {
 	const headers = ctx.request?.headers;
 	if (!headers || !ctx.request) return;
-	const originHeader = headers.get("origin") || headers.get("referer") || "";
+	const origin = headers.get("origin");
+	const originHeader = origin || headers.get("referer") || "";
 	const useCookies = headers.has("cookie");
 	if (ctx.context.skipCSRFCheck) return;
 	if (shouldSkipCSRFForBackwardCompat(ctx)) {
@@ -104,11 +106,13 @@ async function validateOrigin(ctx, forceValidate = false) {
 	}
 	if (shouldSkipOriginCheck(ctx)) return;
 	if (!(forceValidate || useCookies)) return;
-	if (!originHeader || originHeader === "null") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN);
+	const inferredBaseURL = origin === "null" && headers.get("sec-fetch-site") === "same-origin" ? getBaseURL(void 0, ctx.context.options.basePath, ctx.request, false, ctx.context.options.advanced?.trustedProxyHeaders) : void 0;
+	const originToValidate = (inferredBaseURL ? getOrigin(inferredBaseURL) : void 0) ?? originHeader;
+	if (!originToValidate || originToValidate === "null") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN);
 	const trustedOrigins = Array.isArray(ctx.context.options.trustedOrigins) ? ctx.context.trustedOrigins : [...ctx.context.trustedOrigins, ...(await ctx.context.options.trustedOrigins?.(ctx.request))?.filter((v) => Boolean(v)) || []];
-	if (!trustedOrigins.some((origin) => matchesOriginPattern(originHeader, origin))) {
-		ctx.context.logger.error(`Invalid origin: ${originHeader}`);
-		ctx.context.logger.info(`If it's a valid URL, please add ${originHeader} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${trustedOrigins}`);
+	if (!trustedOrigins.some((origin) => matchesOriginPattern(originToValidate, origin))) {
+		ctx.context.logger.error(`Invalid origin: ${originToValidate}`);
+		ctx.context.logger.info(`If it's a valid URL, please add ${originToValidate} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${trustedOrigins}`);
 		throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ORIGIN);
 	}
 }

package/dist/api/routes/callback.mjs

@@ -10,6 +10,7 @@ import { generateIdTokenNonce, generateState, parseState } from "../../oauth2/st
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { mergeScopes } from "@better-auth/core/oauth2";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/api/routes/callback.ts
@@ -52,7 +53,8 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		else throw new Error("Unsupported method");
 	} catch (e) {
 		c.context.logger.error("INVALID_CALLBACK_REQUEST", e);
-		throw c.redirect(`${defaultErrorURL}?error=invalid_callback_request`);
+		const redirectURL = appendQueryParams(defaultErrorURL, new URLSearchParams({ error: "invalid_callback_request" }));
+		throw c.redirect(redirectURL);
 	}
 	const { code, error, state, error_description, device_id, user: userData, iss } = queryOrBody;
 	if (state === void 0 && code) {
@@ -71,16 +73,16 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 	}
 	if (!state) {
 		c.context.logger.error("State not found", error);
-		const url = `${defaultErrorURL}${defaultErrorURL.includes("?") ? "&" : "?"}error=state_not_found`;
-		throw c.redirect(url);
+		const redirectURL = appendQueryParams(defaultErrorURL, new URLSearchParams({ error: "state_not_found" }));
+		throw c.redirect(redirectURL);
 	}
 	const { codeVerifier, callbackURL, link, errorURL, newUserURL, requestSignUp, idTokenNonce } = await parseState(c);
 	function redirectOnError(error, description) {
 		const baseURL = errorURL ?? defaultErrorURL;
 		const params = new URLSearchParams({ error });
 		if (description) params.set("error_description", description);
-		const url = `${baseURL}${baseURL.includes("?") ? "&" : "?"}${params.toString()}`;
-		throw c.redirect(url);
+		const redirectURL = appendQueryParams(baseURL, params);
+		throw c.redirect(redirectURL);
 	}
 	if (error) redirectOnError(error, error_description);
 	if (!code) {

package/dist/api/routes/email-verification.mjs

@@ -5,6 +5,7 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "./session.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 import { jwtVerify } from "jose";
@@ -165,8 +166,9 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 }, async (ctx) => {
 	function redirectOnError(error) {
 		if (ctx.query.callbackURL) {
-			if (ctx.query.callbackURL.includes("?")) throw ctx.redirect(`${ctx.query.callbackURL}&error=${error.code}`);
-			throw ctx.redirect(`${ctx.query.callbackURL}?error=${error.code}`);
+			const params = new URLSearchParams({ error: error.code });
+			const redirectURL = appendQueryParams(ctx.query.callbackURL, params);
+			throw ctx.redirect(redirectURL);
 		}
 		throw APIError.from("UNAUTHORIZED", error);
 	}

package/dist/api/routes/error.mjs

@@ -1,5 +1,6 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { isProduction } from "@better-auth/core/env";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 //#region src/api/routes/error.ts
 function sanitize(input) {
@@ -364,18 +365,21 @@ const error = createAuthEndpoint("/error", {
 	const unsanitizedDescription = url.searchParams.get("error_description") || null;
 	const safeCode = /^[\'A-Za-z0-9_-]+$/.test(unsanitizedCode || "") ? unsanitizedCode : "UNKNOWN";
 	const safeDescription = unsanitizedDescription ? sanitize(unsanitizedDescription) : null;
-	const queryParams = new URLSearchParams();
-	queryParams.set("error", safeCode);
-	if (unsanitizedDescription) queryParams.set("error_description", unsanitizedDescription);
+	const params = new URLSearchParams();
+	params.set("error", safeCode);
+	if (unsanitizedDescription) params.set("error_description", unsanitizedDescription);
 	const options = c.context.options;
 	const errorURL = options.onAPIError?.errorURL;
-	if (errorURL) return new Response(null, {
-		status: 302,
-		headers: { Location: `${errorURL}${errorURL.includes("?") ? "&" : "?"}${queryParams.toString()}` }
-	});
+	if (errorURL) {
+		const redirectURL = appendQueryParams(errorURL, params);
+		return new Response(null, {
+			status: 302,
+			headers: { Location: redirectURL }
+		});
+	}
 	if (isProduction && !options.onAPIError?.customizeDefaultErrorPage) return new Response(null, {
 		status: 302,
-		headers: { Location: `/?${queryParams.toString()}` }
+		headers: { Location: `/?${params.toString()}` }
 	});
 	return new Response(html(c.context.options, safeCode, safeDescription), { headers: { "Content-Type": "text/html" } });
 });

package/dist/api/routes/sign-in.mjs

@@ -9,6 +9,7 @@ import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
+import "../../utils/index.mjs";
 import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";

package/dist/auth/trusted-origins.mjs

@@ -54,6 +54,26 @@ const parseCustomSchemeOrigin = (value) => {
 		path
 	};
 };
+const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
+const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
+const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
+/**
+* Validates root-relative redirects against ambiguous browser and router parsing.
+*
+* @see https://www.rfc-editor.org/rfc/rfc3986.html#section-4.2
+* @see https://url.spec.whatwg.org/#concept-basic-url-parser
+*/
+const isSafeRelativeURL = (value) => {
+	if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\") || CONTROL_CHARACTER_PATTERN.test(value)) return false;
+	const pathEnd = value.search(/[?#]/);
+	const path = pathEnd === -1 ? value : value.slice(0, pathEnd);
+	if (ENCODED_PATH_SEPARATOR_PATTERN.test(path)) return false;
+	try {
+		return new URL(value, RELATIVE_URL_PARSER_ORIGIN).origin === RELATIVE_URL_PARSER_ORIGIN;
+	} catch {
+		return false;
+	}
+};
 /**
 * Matches the given url against an origin or origin pattern
 * See "options.trustedOrigins" for details of supported patterns
@@ -64,10 +84,7 @@ const parseCustomSchemeOrigin = (value) => {
 * @returns {boolean} true if the URL matches the origin pattern, false otherwise.
 */
 const matchesOriginPattern = (url, pattern, settings) => {
-	if (url.startsWith("/")) {
-		if (settings?.allowRelativePaths) return url.startsWith("/") && /^\/(?!\/|\\|%2f|%5c)[\w\-.\+/@]*(?:\?[\w\-.\+/=&%@]*)?$/.test(url);
-		return false;
-	}
+	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
 	if (pattern.includes("*") || pattern.includes("?")) {
 		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
 		const host = getHost(url);

package/dist/client/lynx/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Lynx client returned by `createAuthClient`.
  */
 type LynxAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => {
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/react/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * React client returned by `createAuthClient`.
  */
 type ReactAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => {
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/solid/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Solid client returned by `createAuthClient`.
  */
 type SolidAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => Accessor<{
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/svelte/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Svelte client returned by `createAuthClient`.
  */
 type SvelteAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => Atom<{
     data: ClientSession<Option>;
     error: BetterFetchError | null;

package/dist/client/vanilla.d.mts

@@ -20,7 +20,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Client returned by `createAuthClient`.
  */
 type AuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: Atom<{
     data: ClientSession<Option>;
     error: BetterFetchError | null;

package/dist/client/vue/index.d.mts

@@ -42,7 +42,7 @@ type VueUseSession<Option extends BetterAuthClientOptions> = {
  * Vue client returned by `createAuthClient`.
  */
 type VueAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: VueUseSession<Option>;
   $Infer: {
     Session: NonNullable<ClientSession<Option>>;

package/dist/cookies/cache.mjs

@@ -1,4 +1,5 @@
 import { sessionSchema, userSchema } from "@better-auth/core/db";
+import { logger } from "@better-auth/core/env";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import * as z from "zod";
 //#region src/cookies/cache.ts
@@ -14,8 +15,15 @@ const compactCookieCacheSchema = z.object({
 	signature: z.string()
 });
 function parseCookieCachePayload(value) {
-	const result = cookieCachePayloadSchema.safeParse(safeJSONParse(value));
-	return result.success ? result.data : null;
+	const parsed = safeJSONParse(value);
+	if (parsed === null) return null;
+	const result = cookieCachePayloadSchema.safeParse(parsed);
+	if (result.success) return result.data;
+	logger.warn("Cookie cache payload failed schema validation", { issues: result.error.issues.map(({ code, path }) => ({
+		code,
+		path
+	})) });
+	return null;
 }
 function parseCompactCookieCache(value) {
 	const result = compactCookieCacheSchema.safeParse(value);

package/dist/db/get-migration.d.mts

@@ -1,11 +1,37 @@
 import { BetterAuthOptions } from "@better-auth/core";
 import { DBFieldAttribute, DBFieldType } from "@better-auth/core/db";
+import { BetterAuthError } from "@better-auth/core/error";
 import { KyselyDatabaseType } from "@better-auth/kysely-adapter";
 import { ResolvedDBTableIndex } from "@better-auth/core/db/internal";
 
 //#region src/db/get-migration.d.ts
+/**
+ * Thrown when {@link getMigrations} refuses to add a required column with no
+ * default value to a populated table. Distinct from the plain
+ * {@link BetterAuthError} thrown for index-definition conflicts, so callers
+ * can tell the two apart without matching on message text.
+ */
+declare class UnsafeMigrationError extends BetterAuthError {}
 declare function matchType(columnDataType: string, fieldType: DBFieldType, dbType: KyselyDatabaseType): boolean;
-declare function getMigrations(config: BetterAuthOptions): Promise<{
+/**
+ * Build the migration plan that `auth migrate` executes and `auth generate`
+ * prints for the Kysely adapter.
+ *
+ * Adding a required column without a default to a populated table is refused:
+ * existing rows have no value to backfill. `throwOnUnsafe` picks how that
+ * refusal is delivered: executing callers get an {@link UnsafeMigrationError},
+ * read-only callers get the plan plus the same message in `unsafeChanges`.
+ *
+ * @throws {UnsafeMigrationError} when a required column cannot be migrated
+ * safely and `throwOnUnsafe` is left on.
+ * @throws {BetterAuthError} when an index definition conflicts with an
+ * existing or already-planned index.
+ */
+declare function getMigrations(config: BetterAuthOptions, {
+  throwOnUnsafe
+}?: {
+  throwOnUnsafe?: boolean;
+}): Promise<{
   toBeCreated: {
     table: string;
     fields: Record<string, DBFieldAttribute>;
@@ -21,8 +47,9 @@ declare function getMigrations(config: BetterAuthOptions): Promise<{
     index: ResolvedDBTableIndex;
     name: string;
   }[];
+  unsafeChanges: string[];
   runMigrations: () => Promise<void>;
   compileMigrations: () => Promise<string>;
 }>;
 //#endregion
-export { getMigrations, matchType };
+export { UnsafeMigrationError, getMigrations, matchType };

package/dist/db/get-migration.mjs

@@ -103,7 +103,20 @@ function databaseValueIsTrue(value) {
 	if (typeof value === "number") return value !== 0;
 	return value === "1" || value?.toLowerCase() === "true" || value === "t";
 }
-async function getDatabaseIndexes(db, dbType, schemaName) {
+function toDatabaseIndexMap(indexes) {
+	return new Map(indexes.map((index) => {
+		const columns = [...index.columns].sort((left, right) => left.position - right.position);
+		return [createDatabaseIndexKey(index.table, index.name), {
+			columns: columns.flatMap((column) => column.name === null ? [] : [column.name]),
+			name: index.name,
+			table: index.table,
+			unique: index.unique,
+			validFullColumns: index.valid && !index.partial && columns.length > 0 && columns.every((column) => column.name !== null && column.fullLength)
+		}];
+	}));
+}
+async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspectIndexes) {
+	if (introspectIndexes) return toDatabaseIndexMap(await introspectIndexes(tableNames));
 	let rows;
 	if (dbType === "sqlite") rows = (await sql`
 				SELECT
@@ -151,7 +164,8 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 					column_name AS columnName,
 					non_unique AS nonUnique,
 					seq_in_index AS columnPosition,
-					sub_part AS prefixLength
+					sub_part AS prefixLength,
+					COALESCE(LOWER(comment) = 'disabled', FALSE) AS isDisabled
 				FROM information_schema.statistics
 				WHERE table_schema = DATABASE()
 			`.execute(db)).rows;
@@ -180,7 +194,7 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 					AND indexes.name IS NOT NULL
 					AND index_columns.key_ordinal > 0
 			`.execute(db)).rows;
-	const indexRows = /* @__PURE__ */ new Map();
+	const indexMetadata = /* @__PURE__ */ new Map();
 	for (const row of rows) {
 		const table = row.tableName ?? row.table_name ?? row.TABLE_NAME ?? row.tablename ?? row.tbl_name;
 		const name = row.indexName ?? row.index_name ?? row.INDEX_NAME ?? row.name;
@@ -190,28 +204,29 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 		const nonUnique = row.nonUnique ?? row.non_unique ?? row.NON_UNIQUE;
 		const unique = nonUnique === void 0 ? databaseValueIsTrue(row.isUnique ?? row.is_unique) : !databaseValueIsTrue(nonUnique);
 		const position = Number(row.columnPosition ?? row.column_position ?? row.keyOrdinal ?? row.key_ordinal ?? row.ordinality ?? row.seqInIndex ?? row.seq_in_index ?? row.SEQ_IN_INDEX ?? row.seqno ?? 0);
-		const index = indexRows.get(key) ?? {
-			columns: [],
+		const indexColumn = {
+			fullLength: column !== void 0 && column !== null && (row.prefixLength === void 0 || row.prefixLength === null),
+			name: column ?? null,
+			position
+		};
+		const partial = databaseValueIsTrue(row.isPartial);
+		const valid = !databaseValueIsTrue(row.isDisabled) && !databaseValueIsTrue(row.isHypothetical) && (row.isValid === void 0 || databaseValueIsTrue(row.isValid));
+		const existing = indexMetadata.get(key);
+		indexMetadata.set(key, existing ? {
+			...existing,
+			columns: [...existing.columns, indexColumn],
+			partial: existing.partial || partial,
+			valid: existing.valid && valid
+		} : {
+			columns: [indexColumn],
 			name,
+			partial,
 			table,
 			unique,
-			validFullColumns: true
-		};
-		if (column) index.columns.push({
-			name: column,
-			position
+			valid
 		});
-		else index.validFullColumns = false;
-		if (databaseValueIsTrue(row.isPartial) || databaseValueIsTrue(row.isDisabled) || databaseValueIsTrue(row.isHypothetical) || row.isValid !== void 0 && !databaseValueIsTrue(row.isValid) || row.prefixLength !== void 0 && row.prefixLength !== null) index.validFullColumns = false;
-		indexRows.set(key, index);
 	}
-	return new Map([...indexRows].map(([key, index]) => [key, {
-		columns: index.columns.sort((left, right) => left.position - right.position).map((column) => column.name),
-		name: index.name,
-		table: index.table,
-		unique: index.unique,
-		validFullColumns: index.validFullColumns
-	}]));
+	return toDatabaseIndexMap([...indexMetadata.values()]);
 }
 async function getDatabaseColumnBounds(db, dbType, schemaName) {
 	if (dbType !== "mysql" && dbType !== "mssql") return /* @__PURE__ */ new Map();
@@ -278,6 +293,24 @@ function assertExistingTableIndexFits({ columnBounds, dbType, existingColumns, f
 	}
 	if (requiredBytes > byteBudget) throw new BetterAuthError(`Cannot create database index "${index.name}" on existing table "${table}" because its columns can exceed ${dbType === "mysql" ? "MySQL" : "SQL Server"}'s ${byteBudget}-byte index-key limit. Bound the indexed string columns to the generated schema lengths, resolve oversized values, then run the migration again.`);
 }
+const columnBackfillGuideUrl = "https://better-auth.com/docs/guides/1-7-upgrade-guide#account-identity-is-scoped-by-issuer";
+/**
+* Thrown when {@link getMigrations} refuses to add a required column with no
+* default value to a populated table. Distinct from the plain
+* {@link BetterAuthError} thrown for index-definition conflicts, so callers
+* can tell the two apart without matching on message text.
+*/
+var UnsafeMigrationError = class extends BetterAuthError {};
+function hasTimestampColumnDefault(field, dbType) {
+	return field.type === "date" && typeof field.defaultValue === "function" && (dbType === "postgres" || dbType === "mysql" || dbType === "mssql");
+}
+function hasStaticColumnDefault(field) {
+	return !(field.unique && field.required === false) && (field.type === "string" || field.type === "number" || field.type === "boolean") && field.defaultValue !== void 0 && field.defaultValue !== null && typeof field.defaultValue !== "function";
+}
+async function tableHasRows(db, dbType, table) {
+	const probe = db.selectFrom(table).select(sql`1`.as("present"));
+	return (await (dbType === "mssql" ? probe.top(1) : probe.limit(1)).execute()).length > 0;
+}
 function matchType(columnDataType, fieldType, dbType) {
 	function normalize(type) {
 		return type.toLowerCase().split("(")[0].trim();
@@ -307,10 +340,35 @@ async function getMssqlSchema(db) {
 		return "dbo";
 	}
 }
-async function getMigrations(config) {
+/**
+* Build the migration plan that `auth migrate` executes and `auth generate`
+* prints for the Kysely adapter.
+*
+* Adding a required column without a default to a populated table is refused:
+* existing rows have no value to backfill. `throwOnUnsafe` picks how that
+* refusal is delivered: executing callers get an {@link UnsafeMigrationError},
+* read-only callers get the plan plus the same message in `unsafeChanges`.
+*
+* @throws {UnsafeMigrationError} when a required column cannot be migrated
+* safely and `throwOnUnsafe` is left on.
+* @throws {BetterAuthError} when an index definition conflicts with an
+* existing or already-planned index.
+*/
+async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 	const betterAuthSchema = getSchema(config);
+	const authTables = getAuthTables(config);
+	const accountIssuer = authTables.account && {
+		table: authTables.account.modelName,
+		column: authTables.account.fields.issuer?.fieldName || "issuer"
+	};
+	const isAccountIssuerColumn = (table, column) => table === accountIssuer?.table && column === accountIssuer.column;
 	const logger = createLogger(config.logger);
-	let { kysely: db, databaseType: dbType } = await createKyselyAdapter(config);
+	const unsafeChanges = [];
+	const reportUnsafeChange = (message) => {
+		if (throwOnUnsafe) throw new UnsafeMigrationError(message);
+		unsafeChanges.push(message);
+	};
+	let { kysely: db, databaseType: dbType, introspectIndexes } = await createKyselyAdapter(config);
 	if (!dbType) {
 		logger.warn("Could not determine database type, defaulting to sqlite. Please provide a type in the database options to avoid this.");
 		dbType = "sqlite";
@@ -335,7 +393,7 @@ async function getMigrations(config) {
 		}
 	} else if (dbType === "mssql") logger.debug(`SQL Server migration: Using schema '${currentSchema}' (from the current user's default schema)`);
 	const allTableMetadata = await db.introspection.getTables();
-	const databaseIndexes = await getDatabaseIndexes(db, dbType, currentSchema);
+	const databaseIndexMap = await getDatabaseIndexMap(db, dbType, currentSchema, allTableMetadata.map((table) => table.name), introspectIndexes);
 	const databaseColumnBounds = await getDatabaseColumnBounds(db, dbType, currentSchema);
 	let tableMetadata = allTableMetadata;
 	if (dbType === "postgres") try {
@@ -362,13 +420,13 @@ async function getMigrations(config) {
 		for (const index of value.indexes ?? []) {
 			const name = index.name;
 			const indexKey = createDatabaseIndexKey(key, name);
-			const existingIndex = databaseIndexes.get(indexKey);
+			const existingIndex = databaseIndexMap.get(indexKey);
 			if (existingIndex) {
 				if (!databaseIndexMatches(existingIndex, index)) throw new BetterAuthError(`Database index "${name}" on table "${key}" does not match the configured fields and uniqueness. Rename or replace the existing index, then run the migration again.`);
 				continue;
 			}
 			if (dbType === "sqlite" || dbType === "postgres") {
-				const indexOnAnotherTable = [...databaseIndexes.values()].find((databaseIndex) => getPortableDatabaseIdentifierKey(databaseIndex.name) === getPortableDatabaseIdentifierKey(name) && getPortableDatabaseIdentifierKey(databaseIndex.table) !== getPortableDatabaseIdentifierKey(key));
+				const indexOnAnotherTable = [...databaseIndexMap.values()].find((databaseIndex) => getPortableDatabaseIdentifierKey(databaseIndex.name) === getPortableDatabaseIdentifierKey(name) && getPortableDatabaseIdentifierKey(databaseIndex.table) !== getPortableDatabaseIdentifierKey(key));
 				if (indexOnAnotherTable) throw new BetterAuthError(`Database index name "${name}" is already used by table "${indexOnAnotherTable.table}". Index names must be unique across the schema.`);
 			}
 			const plannedIndex = plannedIndexes.get(indexKey);
@@ -421,6 +479,7 @@ async function getMigrations(config) {
 				toBeAddedFields[fieldName] = field;
 				continue;
 			}
+			if (field.required !== false && column.isNullable) logger.warn(`Column "${fieldName}" on table "${key}" stays nullable while the schema declares the field required, so existing rows can still hold null. Backfill every row for this column and enforce NOT NULL to remove the drift.`);
 			if (matchType(column.dataType, field.type, dbType)) continue;
 			else logger.warn(`Field ${fieldName} in table ${key} has a different type in the database. Expected ${field.type} but got ${column.dataType}.`);
 		}
@@ -501,11 +560,11 @@ async function getMigrations(config) {
 		return typeMap[type][provider];
 	}
 	const getModelName = initGetModelName({
-		schema: getAuthTables(config),
+		schema: authTables,
 		usePlural: false
 	});
 	const getFieldName = initGetFieldName({
-		schema: getAuthTables(config),
+		schema: authTables,
 		usePlural: false
 	});
 	function getReferencePath(model, field) {
@@ -530,28 +589,45 @@ async function getMigrations(config) {
 			indexes: table.indexes ?? []
 		});
 	};
-	if (toBeAdded.length) for (const table of toBeAdded) for (const [fieldName, field] of Object.entries(table.fields)) {
-		const type = getType(field, fieldName, getTableIndexStringLength(table.table, fieldName));
-		const builder = db.schema.alterTable(table.table);
-		if (field.index || field.unique) {
-			const indexName = getDatabaseFieldIndexName(table.table, fieldName, field.unique ?? false);
-			let indexBuilder = db.schema.createIndex(indexName).on(table.table).columns([fieldName]);
-			if (field.unique) {
-				indexBuilder = indexBuilder.unique();
-				if (field.required === false && dbType === "mssql") indexBuilder = indexBuilder.where(fieldName, "is not", null);
-				if (field.required !== false && field.defaultValue !== void 0 && field.defaultValue !== null && typeof field.defaultValue !== "function") logger.warn(`Adding unique column "${fieldName}" to existing table "${table.table}" backfills every existing row with its default value. If the table has more than one row, creating the unique index "${indexName}" will fail; backfill distinct values manually, then re-run the migration or create the index yourself.`);
+	if (toBeAdded.length) {
+		const populatedTables = /* @__PURE__ */ new Map();
+		for (const table of toBeAdded) for (const [fieldName, field] of Object.entries(table.fields)) {
+			const timestampDefault = hasTimestampColumnDefault(field, dbType);
+			const staticDefault = hasStaticColumnDefault(field);
+			if (field.required !== false && !timestampDefault && !staticDefault) {
+				let populated = populatedTables.get(table.table);
+				if (populated === void 0) {
+					populated = await tableHasRows(db, dbType, table.table);
+					populatedTables.set(table.table, populated);
+				}
+				if (populated) {
+					const textDetail = field.type === "string" ? " For a text column, every existing row ends up with the same empty string." : "";
+					const guideLink = isAccountIssuerColumn(table.table, fieldName) ? ` See ${columnBackfillGuideUrl}` : "";
+					reportUnsafeChange(`Cannot add required column "${fieldName}" to populated table "${table.table}": the schema declares no default value, so existing rows have no value to backfill. MySQL accepts this statement instead of rejecting it and fills every existing row with an implicit default for the column type, reporting a successful migration over corrupted data.${textDetail} Add the column as nullable, backfill a correct value for every row, then make it NOT NULL.${guideLink}`);
+				}
 			}
-			deferredIndexes.push(indexBuilder);
+			const type = getType(field, fieldName, getTableIndexStringLength(table.table, fieldName));
+			const builder = db.schema.alterTable(table.table);
+			if (field.index || field.unique) {
+				const indexName = getDatabaseFieldIndexName(table.table, fieldName, field.unique ?? false);
+				let indexBuilder = db.schema.createIndex(indexName).on(table.table).columns([fieldName]);
+				if (field.unique) {
+					indexBuilder = indexBuilder.unique();
+					if (field.required === false && dbType === "mssql") indexBuilder = indexBuilder.where(fieldName, "is not", null);
+					if (field.required !== false && field.defaultValue !== void 0 && field.defaultValue !== null && typeof field.defaultValue !== "function") logger.warn(`Adding unique column "${fieldName}" to existing table "${table.table}" backfills every existing row with its default value. If the table has more than one row, creating the unique index "${indexName}" will fail; backfill distinct values manually, then re-run the migration or create the index yourself.`);
+				}
+				deferredIndexes.push(indexBuilder);
+			}
+			const built = builder.addColumn(fieldName, type, (col) => {
+				col = field.required !== false ? col.notNull() : col;
+				if (field.references) col = col.references(getReferencePath(field.references.model, field.references.field)).onDelete(field.references.onDelete || "cascade");
+				if (timestampDefault) if (dbType === "mysql") col = col.defaultTo(sql`CURRENT_TIMESTAMP(3)`);
+				else col = col.defaultTo(sql`CURRENT_TIMESTAMP`);
+				else if (staticDefault) col = col.defaultTo(typeof field.defaultValue === "boolean" && (dbType === "sqlite" || dbType === "mssql") ? field.defaultValue ? 1 : 0 : field.defaultValue);
+				return col;
+			});
+			migrations.push(built);
 		}
-		const built = builder.addColumn(fieldName, type, (col) => {
-			col = field.required !== false ? col.notNull() : col;
-			if (field.references) col = col.references(getReferencePath(field.references.model, field.references.field)).onDelete(field.references.onDelete || "cascade");
-			if (field.type === "date" && typeof field.defaultValue === "function" && (dbType === "postgres" || dbType === "mysql" || dbType === "mssql")) if (dbType === "mysql") col = col.defaultTo(sql`CURRENT_TIMESTAMP(3)`);
-			else col = col.defaultTo(sql`CURRENT_TIMESTAMP`);
-			else if (!(field.unique && field.required === false) && (field.type === "string" || field.type === "number" || field.type === "boolean") && field.defaultValue !== void 0 && field.defaultValue !== null && typeof field.defaultValue !== "function") col = col.defaultTo(typeof field.defaultValue === "boolean" && (dbType === "sqlite" || dbType === "mssql") ? field.defaultValue ? 1 : 0 : field.defaultValue);
-			return col;
-		});
-		migrations.push(built);
 	}
 	if (toBeCreated.length) for (const table of toBeCreated) {
 		const idType = getType({ type: useNumberId ? "number" : "string" }, "id");
@@ -601,9 +677,10 @@ async function getMigrations(config) {
 		toBeCreated,
 		toBeAdded,
 		toBeAddedIndexes,
+		unsafeChanges,
 		runMigrations,
 		compileMigrations
 	};
 }
 //#endregion
-export { getMigrations, matchType };
+export { UnsafeMigrationError, getMigrations, matchType };

package/dist/db/internal-adapter.mjs

@@ -3,7 +3,7 @@ import { getDate } from "../utils/date.mjs";
 import { assertValidUserInfo, assertValidUserInfoSource } from "../utils/validate-user-info.mjs";
 import { getStorageOption, processIdentifier } from "./verification-token-storage.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
-import { getCurrentAdapter, getCurrentAuthContext, queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
+import { getCurrentAdapter, getCurrentAuthEndpointContext, queueAfterTransactionHook, runWithTransaction, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
@@ -153,7 +153,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				assertValidUserInfoSource(validationSource);
 				let endpointContext;
 				try {
-					endpointContext = await getCurrentAuthContext();
+					endpointContext = getCurrentAuthEndpointContext();
 				} catch (error) {
 					logger.error("Unable to run validateUserInfo: missing endpoint context", error);
 					throw new APIError("FORBIDDEN", {
@@ -247,7 +247,7 @@ const createInternalAdapter = (adapter, ctx) => {
 		},
 		createSession: async (userId, dontRememberMe, override, overrideAll, storageOptions) => {
 			const headers = await (async () => {
-				const ctx = await getCurrentAuthContext().catch(() => null);
+				const ctx = tryGetCurrentAuthEndpointContext();
 				return ctx?.headers || ctx?.request?.headers;
 			})();
 			const storeInDb = options.session?.storeSessionInDatabase;

package/dist/db/with-hooks.mjs

@@ -1,10 +1,10 @@
-import { getCurrentAdapter, getCurrentAuthContext, queueAfterTransactionHook } from "@better-auth/core/context";
+import { getCurrentAdapter, queueAfterTransactionHook, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_HOOK_TYPE, withSpan } from "@better-auth/core/instrumentation";
 //#region src/db/with-hooks.ts
 function getWithHooks(adapter, ctx) {
 	const hooksEntries = ctx.hooks;
 	async function createWithHooks(data, model, customCreateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.create?.before;
@@ -41,7 +41,7 @@ function getWithHooks(adapter, ctx) {
 		return created;
 	}
 	async function updateWithHooks(data, where, model, customUpdateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.update?.before;
@@ -77,7 +77,7 @@ function getWithHooks(adapter, ctx) {
 		return updated;
 	}
 	async function updateManyWithHooks(data, where, model, customUpdateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.update?.before;
@@ -113,7 +113,7 @@ function getWithHooks(adapter, ctx) {
 		return updated;
 	}
 	async function deleteWithHooks(where, model, customDeleteFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let entityToDelete = null;
 		try {
 			entityToDelete = (await (await getCurrentAdapter(adapter)).findMany({
@@ -150,7 +150,7 @@ function getWithHooks(adapter, ctx) {
 		return deleted;
 	}
 	async function deleteManyWithHooks(where, model, customDeleteFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let entitiesToDelete = [];
 		try {
 			entitiesToDelete = await (await getCurrentAdapter(adapter)).findMany({
@@ -202,7 +202,7 @@ function getWithHooks(adapter, ctx) {
 	* the helper resolves to `null` (no `consumeFn` call, no after hooks).
 	*/
 	async function consumeOneWithHooks(model, hookWhere, consumeFn, preSnapshot) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		const beforeHooks = hooksEntries.flatMap(({ source, hooks }) => {
 			const fn = hooks[model]?.delete?.before;
 			return fn ? [{

package/dist/index.mjs

@@ -2,6 +2,7 @@ import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProt
 import { generateGenericState, parseGenericState } from "./state.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
+import "./utils/index.mjs";
 import { APIError } from "./api/index.mjs";
 import { betterAuth } from "./auth/full.mjs";
 import { getCurrentAdapter } from "@better-auth/core/context";

package/dist/oauth2/errors.mjs

@@ -1,3 +1,4 @@
+import { appendQueryParams } from "@better-auth/core/utils/url";
 //#region src/oauth2/errors.ts
 /**
 * Error codes used in OAuth callback redirects (`?error=<code>`). These are
@@ -33,8 +34,8 @@ const HANDLING_DOCS_URL = "https://www.better-auth.com/docs/concepts/oauth#handl
 function redirectOnError(ctx, errorURL, error, description) {
 	const params = new URLSearchParams({ error });
 	if (description) params.set("error_description", description);
-	const sep = errorURL.includes("?") ? "&" : "?";
-	throw ctx.redirect(`${errorURL}${sep}${params.toString()}`);
+	const redirectURL = appendQueryParams(errorURL, params);
+	throw ctx.redirect(redirectURL);
 }
 /**
 * Build the logger message shown when an OAuth provider does not return an
@@ -42,7 +43,7 @@ function redirectOnError(ctx, errorURL, error, description) {
 * the same workaround docs.
 */
 function missingEmailLogMessage(providerId, options) {
-	return `${options?.source === "generic" ? `Generic OAuth provider "${providerId}"` : `Provider "${providerId}"`} did not return an email${options?.source === "id_token" ? " in the id token" : ""}. Either request the provider's email scope, or synthesize one via \`mapProfileToUser\`. See ${HANDLING_DOCS_URL}`;
+	return `${options?.source === "generic" ? `Generic OAuth provider "${providerId}"` : `Provider "${providerId}"`} did not return an email${options?.source === "id_token" ? " in the id token" : ""}. Either request the provider's email scope, or create a placeholder via \`mapProfileToUser\`. See ${HANDLING_DOCS_URL}`;
 }
 //#endregion
 export { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage, redirectOnError };

package/dist/oauth2/state.mjs

@@ -55,7 +55,7 @@ async function parseState(c) {
 		let redirectErrorURL = errorURL;
 		if (error instanceof StateError) {
 			code = error.code === "state_security_mismatch" ? "state_mismatch" : error.code;
-			redirectErrorURL = error.errorURL ?? errorURL;
+			redirectErrorURL = error.errorURL || errorURL;
 		}
 		redirectOnError(c, redirectErrorURL, code);
 	}

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.0";
+var version = "1.7.2";
 //#endregion
 export { version };

package/dist/plugins/admin/routes.mjs

@@ -534,7 +534,7 @@ const banUser = (opts) => createAuthEndpoint("/admin/ban-user", {
 	const user = await ctx.context.internalAdapter.updateUser(ctx.body.userId, {
 		banned: true,
 		banReason: ctx.body.banReason || opts?.defaultBanReason || "No reason",
-		banExpires: ctx.body.banExpiresIn ? getDate(ctx.body.banExpiresIn, "sec") : opts?.defaultBanExpiresIn ? getDate(opts.defaultBanExpiresIn, "sec") : void 0,
+		banExpires: ctx.body.banExpiresIn ? getDate(ctx.body.banExpiresIn, "sec") : opts?.defaultBanExpiresIn ? getDate(opts.defaultBanExpiresIn, "sec") : null,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
 	await ctx.context.internalAdapter.deleteUserSessions(ctx.body.userId);

package/dist/plugins/anonymous/index.mjs

@@ -10,6 +10,7 @@ import { schema } from "./schema.mjs";
 import { generateId } from "@better-auth/core/utils/id";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/anonymous/index.ts
 /**
 * Resolves the anonymous session being upgraded during an account-link callback.
@@ -51,7 +52,10 @@ async function getAnonUserEmail(options) {
 	}
 	const id = generateId();
 	if (options?.emailDomainName) return `temp-${id}@${options.emailDomainName}`;
-	return `temp@${id}.com`;
+	return createPlaceholderEmail({
+		identifier: id,
+		namespace: "anonymous"
+	});
 }
 const anonymous = (options) => {
 	return {

package/dist/plugins/anonymous/types.d.mts

@@ -18,9 +18,8 @@ interface UserWithAnonymous extends User {
 }
 interface AnonymousOptions {
   /**
-   * Configure the domain name of the temporary email
-   * address for anonymous users in the database.
-   * @default "baseURL"
+   * Configure a custom domain for anonymous user email addresses.
+   * @default "anonymous.placeholder.invalid"
    */
   emailDomainName?: string | undefined;
   /**

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.mjs

@@ -1,5 +1,6 @@
 import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/generic-oauth/providers/microsoft-entra-id.ts
 function getMicrosoftProfileName(profile) {
 	return profile.name ?? (`${profile.given_name ?? profile.givenname ?? ""} ${profile.family_name ?? profile.familyname ?? ""}`.trim() || void 0);
@@ -46,25 +47,34 @@ function microsoftEntraId(options) {
 		} catch {
 			return null;
 		}
-		if (!(typeof tokenProfile.oid === "string" && tokenProfile.oid.trim().length > 0 ? tokenProfile.oid : void 0)) return null;
+		const oid = typeof tokenProfile.oid === "string" && tokenProfile.oid.trim().length > 0 ? tokenProfile.oid : void 0;
+		if (!oid) return null;
+		const tokenEmail = tokenProfile.email;
 		const tokenUserInfo = {
 			...tokenProfile,
 			name: getMicrosoftProfileName(tokenProfile),
-			email: tokenProfile.email ?? tokenProfile.preferred_username ?? void 0,
+			email: tokenEmail ?? createPlaceholderEmail({
+				identifier: oid,
+				namespace: "microsoft-entra-id"
+			}),
 			image: tokenProfile.picture,
-			emailVerified: tokenProfile.email_verified ?? false
+			emailVerified: tokenEmail ? tokenProfile.email_verified ?? false : false
 		};
 		if (!tokens.accessToken) return tokenUserInfo;
 		const { data: profile, error } = await betterFetch(userInfoUrl, { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
 		if (error || !profile) return tokenUserInfo;
 		if (typeof tokenProfile.sub !== "string" || profile.sub !== tokenProfile.sub) return tokenUserInfo;
+		const emailClaim = tokenProfile.email ?? profile.email;
 		return {
 			...profile,
 			...tokenProfile,
 			name: getMicrosoftProfileName(tokenProfile) ?? getMicrosoftProfileName(profile),
-			email: tokenProfile.email ?? profile.email ?? tokenProfile.preferred_username ?? profile.preferred_username ?? void 0,
+			email: emailClaim ?? createPlaceholderEmail({
+				identifier: oid,
+				namespace: "microsoft-entra-id"
+			}),
 			image: tokenProfile.picture ?? profile.picture,
-			emailVerified: tokenProfile.email_verified ?? profile.email_verified ?? false
+			emailVerified: emailClaim != null ? tokenProfile.email_verified ?? profile.email_verified ?? false : false
 		};
 	};
 	return {

package/dist/plugins/haveibeenpwned/index.mjs

@@ -1,7 +1,7 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
-import { getCurrentAuthContext } from "@better-auth/core/context";
+import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
@@ -46,7 +46,7 @@ const haveIBeenPwned = (options) => {
 				...ctx.password,
 				async hash(password) {
 					if (options?.enabled === false) return originalHash(password);
-					const c = await getCurrentAuthContext();
+					const c = getCurrentAuthEndpointContext();
 					if (!c.path || !paths.includes(c.path)) return originalHash(password);
 					await checkPasswordCompromise(password, options?.customPasswordCompromisedMessage);
 					return originalHash(password);

package/dist/plugins/jwt/verify.mjs

@@ -1,5 +1,5 @@
 import { getJwksAdapter } from "./adapter.mjs";
-import { getCurrentAuthContext } from "@better-auth/core/context";
+import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { base64 } from "@better-auth/utils/base64";
 import { importJWK, jwtVerify } from "jose";
 //#region src/plugins/jwt/verify.ts
@@ -8,7 +8,7 @@ import { importJWK, jwtVerify } from "jose";
 * Returns the payload if valid, null otherwise
 */
 async function verifyJWT(token, options) {
-	const ctx = await getCurrentAuthContext();
+	const ctx = getCurrentAuthEndpointContext();
 	try {
 		const parts = token.split(".");
 		if (parts.length !== 3) return null;

package/dist/plugins/open-api/index.mjs

@@ -1,4 +1,5 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import "../../utils/index.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { generator } from "./generator.mjs";

package/dist/plugins/phone-number/routes.mjs

@@ -4,6 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import "../../utils/index.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";

package/dist/plugins/siwe/index.mjs

@@ -1,5 +1,4 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
-import { getOrigin } from "../../utils/url.mjs";
 import { mergeSchema } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { APIError } from "../../api/index.mjs";
@@ -10,6 +9,7 @@ import { schema } from "./schema.mjs";
 import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/siwe/index.ts
 const signedWalletAddressSchema = z.string().regex(/^0x[a-fA-F0-9]{40}$/).length(42);
 const SIWE_VERIFICATION_IDENTIFIER_PREFIX = "siwe:";
@@ -162,9 +162,11 @@ const siwe = (options) => {
 						});
 					}
 					if (!user) {
-						const domain = options.emailDomainName ?? getOrigin(ctx.context.baseURL);
 						const normalizedEmail = email?.toLowerCase();
-						const walletEmail = `${walletAddress}@${domain}`;
+						const walletEmail = options.emailDomainName ? `${walletAddress}@${options.emailDomainName}` : createPlaceholderEmail({
+							identifier: walletAddress,
+							namespace: "siwe"
+						});
 						let userEmail = walletEmail;
 						let emailClaimIdentifier;
 						if (!isAnon && normalizedEmail) {

package/dist/test-utils/http-test-instance.d.mts

@@ -61,7 +61,7 @@ declare function getHttpTestInstance<O extends Partial<BetterAuthOptions>, C ext
   port: number;
   auth: Auth<O>;
   client: {
-    hydrateSession: (session: null) => void;
+    hydrateSession(session: null): void;
     useSession: _$nanostores.Atom<{
       data: never;
       error: _$_better_fetch_fetch0.BetterFetchError | null;

package/dist/test-utils/test-instance.mjs

@@ -7,7 +7,7 @@ import { createAuthClient } from "../client/vanilla.mjs";
 import { bearer } from "../plugins/bearer/index.mjs";
 import { sql } from "kysely";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { afterAll } from "vitest";
 //#region src/test-utils/test-instance.ts
 const cleanupSet = /* @__PURE__ */ new Set();
@@ -18,6 +18,17 @@ afterAll(async () => {
 		cleanupSet.delete(cleanup);
 	}
 });
+const TEST_PASSWORD_HASH_PREFIX = "$test$sha256$";
+/**
+* Intentionally fast for tests
+*/
+function createTestPasswordHash(password) {
+	return `${TEST_PASSWORD_HASH_PREFIX}${createHash("sha256").update(password.normalize("NFKC")).digest("hex")}`;
+}
+const testPassword = {
+	hash: async (password) => createTestPasswordHash(password),
+	verify: async ({ hash, password }) => hash === createTestPasswordHash(password)
+};
 async function getTestInstance(options, config) {
 	const testWith = config?.testWith || "sqlite";
 	const postgresSchema = testWith === "postgres" ? `ba_test_${randomUUID().replaceAll("-", "_")}` : void 0;
@@ -83,6 +94,11 @@ async function getTestInstance(options, config) {
 		baseURL: "http://localhost:" + (config?.port || 3e3),
 		...opts,
 		...options,
+		emailAndPassword: {
+			...opts.emailAndPassword,
+			...options?.emailAndPassword,
+			password: options?.emailAndPassword?.password ?? testPassword
+		},
 		plugins: [bearer(), ...options?.plugins || []]
 	});
 	const testUser = {

package/dist/utils/index.mjs

@@ -0,0 +1,5 @@
+import "./url.mjs";
+import "../state.mjs";
+import "../oauth2/state.mjs";
+import "./hide-metadata.mjs";
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -473,13 +473,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.7.0",
-    "@better-auth/drizzle-adapter": "1.7.0",
-    "@better-auth/kysely-adapter": "1.7.0",
-    "@better-auth/memory-adapter": "1.7.0",
-    "@better-auth/mongo-adapter": "1.7.0",
-    "@better-auth/prisma-adapter": "1.7.0",
-    "@better-auth/telemetry": "1.7.0"
+    "@better-auth/core": "1.7.2",
+    "@better-auth/drizzle-adapter": "1.7.2",
+    "@better-auth/kysely-adapter": "1.7.2",
+    "@better-auth/memory-adapter": "1.7.2",
+    "@better-auth/mongo-adapter": "1.7.2",
+    "@better-auth/prisma-adapter": "1.7.2",
+    "@better-auth/telemetry": "1.7.2"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -504,7 +504,7 @@
     "tsdown": "0.21.10",
     "type-fest": "^5.7.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.0.18",
+    "vitest": "^4.1.10",
     "vue": "^3.5.29"
   },
   "peerDependencies": {