better-auth 1.7.1 → 1.7.2

package/dist/api/middlewares/origin-check.mjs

@@ -1,3 +1,4 @@
+import { getBaseURL, getOrigin } from "../../utils/url.mjs";
 import { matchesOriginPattern } from "../../auth/trusted-origins.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { normalizePathname } from "@better-auth/core/utils/url";
@@ -95,7 +96,8 @@ const originCheck = (getValue) => createAuthMiddleware(async (ctx) => {
 async function validateOrigin(ctx, forceValidate = false) {
 	const headers = ctx.request?.headers;
 	if (!headers || !ctx.request) return;
-	const originHeader = headers.get("origin") || headers.get("referer") || "";
+	const origin = headers.get("origin");
+	const originHeader = origin || headers.get("referer") || "";
 	const useCookies = headers.has("cookie");
 	if (ctx.context.skipCSRFCheck) return;
 	if (shouldSkipCSRFForBackwardCompat(ctx)) {
@@ -104,11 +106,13 @@ async function validateOrigin(ctx, forceValidate = false) {
 	}
 	if (shouldSkipOriginCheck(ctx)) return;
 	if (!(forceValidate || useCookies)) return;
-	if (!originHeader || originHeader === "null") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN);
+	const inferredBaseURL = origin === "null" && headers.get("sec-fetch-site") === "same-origin" ? getBaseURL(void 0, ctx.context.options.basePath, ctx.request, false, ctx.context.options.advanced?.trustedProxyHeaders) : void 0;
+	const originToValidate = (inferredBaseURL ? getOrigin(inferredBaseURL) : void 0) ?? originHeader;
+	if (!originToValidate || originToValidate === "null") throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.MISSING_OR_NULL_ORIGIN);
 	const trustedOrigins = Array.isArray(ctx.context.options.trustedOrigins) ? ctx.context.trustedOrigins : [...ctx.context.trustedOrigins, ...(await ctx.context.options.trustedOrigins?.(ctx.request))?.filter((v) => Boolean(v)) || []];
-	if (!trustedOrigins.some((origin) => matchesOriginPattern(originHeader, origin))) {
-		ctx.context.logger.error(`Invalid origin: ${originHeader}`);
-		ctx.context.logger.info(`If it's a valid URL, please add ${originHeader} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${trustedOrigins}`);
+	if (!trustedOrigins.some((origin) => matchesOriginPattern(originToValidate, origin))) {
+		ctx.context.logger.error(`Invalid origin: ${originToValidate}`);
+		ctx.context.logger.info(`If it's a valid URL, please add ${originToValidate} to trustedOrigins in your auth config\n`, `Current list of trustedOrigins: ${trustedOrigins}`);
 		throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.INVALID_ORIGIN);
 	}
 }

package/dist/api/routes/callback.mjs

@@ -10,6 +10,7 @@ import { generateIdTokenNonce, generateState, parseState } from "../../oauth2/st
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { mergeScopes } from "@better-auth/core/oauth2";
 import { safeJSONParse } from "@better-auth/core/utils/json";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/api/routes/callback.ts
@@ -52,7 +53,8 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		else throw new Error("Unsupported method");
 	} catch (e) {
 		c.context.logger.error("INVALID_CALLBACK_REQUEST", e);
-		throw c.redirect(`${defaultErrorURL}?error=invalid_callback_request`);
+		const redirectURL = appendQueryParams(defaultErrorURL, new URLSearchParams({ error: "invalid_callback_request" }));
+		throw c.redirect(redirectURL);
 	}
 	const { code, error, state, error_description, device_id, user: userData, iss } = queryOrBody;
 	if (state === void 0 && code) {
@@ -71,16 +73,16 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 	}
 	if (!state) {
 		c.context.logger.error("State not found", error);
-		const url = `${defaultErrorURL}${defaultErrorURL.includes("?") ? "&" : "?"}error=state_not_found`;
-		throw c.redirect(url);
+		const redirectURL = appendQueryParams(defaultErrorURL, new URLSearchParams({ error: "state_not_found" }));
+		throw c.redirect(redirectURL);
 	}
 	const { codeVerifier, callbackURL, link, errorURL, newUserURL, requestSignUp, idTokenNonce } = await parseState(c);
 	function redirectOnError(error, description) {
 		const baseURL = errorURL ?? defaultErrorURL;
 		const params = new URLSearchParams({ error });
 		if (description) params.set("error_description", description);
-		const url = `${baseURL}${baseURL.includes("?") ? "&" : "?"}${params.toString()}`;
-		throw c.redirect(url);
+		const redirectURL = appendQueryParams(baseURL, params);
+		throw c.redirect(redirectURL);
 	}
 	if (error) redirectOnError(error, error_description);
 	if (!code) {

package/dist/api/routes/email-verification.mjs

@@ -5,6 +5,7 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "./session.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 import { jwtVerify } from "jose";
@@ -165,8 +166,9 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 }, async (ctx) => {
 	function redirectOnError(error) {
 		if (ctx.query.callbackURL) {
-			if (ctx.query.callbackURL.includes("?")) throw ctx.redirect(`${ctx.query.callbackURL}&error=${error.code}`);
-			throw ctx.redirect(`${ctx.query.callbackURL}?error=${error.code}`);
+			const params = new URLSearchParams({ error: error.code });
+			const redirectURL = appendQueryParams(ctx.query.callbackURL, params);
+			throw ctx.redirect(redirectURL);
 		}
 		throw APIError.from("UNAUTHORIZED", error);
 	}

package/dist/api/routes/error.mjs

@@ -1,5 +1,6 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { isProduction } from "@better-auth/core/env";
+import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
 //#region src/api/routes/error.ts
 function sanitize(input) {
@@ -364,18 +365,21 @@ const error = createAuthEndpoint("/error", {
 	const unsanitizedDescription = url.searchParams.get("error_description") || null;
 	const safeCode = /^[\'A-Za-z0-9_-]+$/.test(unsanitizedCode || "") ? unsanitizedCode : "UNKNOWN";
 	const safeDescription = unsanitizedDescription ? sanitize(unsanitizedDescription) : null;
-	const queryParams = new URLSearchParams();
-	queryParams.set("error", safeCode);
-	if (unsanitizedDescription) queryParams.set("error_description", unsanitizedDescription);
+	const params = new URLSearchParams();
+	params.set("error", safeCode);
+	if (unsanitizedDescription) params.set("error_description", unsanitizedDescription);
 	const options = c.context.options;
 	const errorURL = options.onAPIError?.errorURL;
-	if (errorURL) return new Response(null, {
-		status: 302,
-		headers: { Location: `${errorURL}${errorURL.includes("?") ? "&" : "?"}${queryParams.toString()}` }
-	});
+	if (errorURL) {
+		const redirectURL = appendQueryParams(errorURL, params);
+		return new Response(null, {
+			status: 302,
+			headers: { Location: redirectURL }
+		});
+	}
 	if (isProduction && !options.onAPIError?.customizeDefaultErrorPage) return new Response(null, {
 		status: 302,
-		headers: { Location: `/?${queryParams.toString()}` }
+		headers: { Location: `/?${params.toString()}` }
 	});
 	return new Response(html(c.context.options, safeCode, safeDescription), { headers: { "Content-Type": "text/html" } });
 });

package/dist/api/routes/sign-in.mjs

@@ -9,6 +9,7 @@ import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
+import "../../utils/index.mjs";
 import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";

package/dist/auth/trusted-origins.mjs

@@ -54,6 +54,26 @@ const parseCustomSchemeOrigin = (value) => {
 		path
 	};
 };
+const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
+const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
+const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
+/**
+* Validates root-relative redirects against ambiguous browser and router parsing.
+*
+* @see https://www.rfc-editor.org/rfc/rfc3986.html#section-4.2
+* @see https://url.spec.whatwg.org/#concept-basic-url-parser
+*/
+const isSafeRelativeURL = (value) => {
+	if (!value.startsWith("/") || value.startsWith("//") || value.includes("\\") || CONTROL_CHARACTER_PATTERN.test(value)) return false;
+	const pathEnd = value.search(/[?#]/);
+	const path = pathEnd === -1 ? value : value.slice(0, pathEnd);
+	if (ENCODED_PATH_SEPARATOR_PATTERN.test(path)) return false;
+	try {
+		return new URL(value, RELATIVE_URL_PARSER_ORIGIN).origin === RELATIVE_URL_PARSER_ORIGIN;
+	} catch {
+		return false;
+	}
+};
 /**
 * Matches the given url against an origin or origin pattern
 * See "options.trustedOrigins" for details of supported patterns
@@ -64,10 +84,7 @@ const parseCustomSchemeOrigin = (value) => {
 * @returns {boolean} true if the URL matches the origin pattern, false otherwise.
 */
 const matchesOriginPattern = (url, pattern, settings) => {
-	if (url.startsWith("/")) {
-		if (settings?.allowRelativePaths) return url.startsWith("/") && /^\/(?!\/|\\|%2f|%5c)[\w\-.\+/@]*(?:\?[\w\-.\+/=&%@]*)?$/.test(url);
-		return false;
-	}
+	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
 	if (pattern.includes("*") || pattern.includes("?")) {
 		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
 		const host = getHost(url);

package/dist/client/lynx/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Lynx client returned by `createAuthClient`.
  */
 type LynxAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => {
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/react/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * React client returned by `createAuthClient`.
  */
 type ReactAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => {
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/solid/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Solid client returned by `createAuthClient`.
  */
 type SolidAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => Accessor<{
     data: ClientSession<Option>;
     isPending: boolean;

package/dist/client/svelte/index.d.mts

@@ -22,7 +22,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Svelte client returned by `createAuthClient`.
  */
 type SvelteAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: () => Atom<{
     data: ClientSession<Option>;
     error: BetterFetchError | null;

package/dist/client/vanilla.d.mts

@@ -20,7 +20,7 @@ type ClientSession<Option extends BetterAuthClientOptions> = InferClientAPI<Opti
  * Client returned by `createAuthClient`.
  */
 type AuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: Atom<{
     data: ClientSession<Option>;
     error: BetterFetchError | null;

package/dist/client/vue/index.d.mts

@@ -42,7 +42,7 @@ type VueUseSession<Option extends BetterAuthClientOptions> = {
  * Vue client returned by `createAuthClient`.
  */
 type VueAuthClient<Option extends BetterAuthClientOptions> = UnionToIntersection<InferResolvedHooks<Option>> & InferClientAPI<Option> & InferActions<Option> & {
-  hydrateSession: (session: NonNullable<ClientSession<Option>> | null) => void;
+  hydrateSession(session: NonNullable<ClientSession<Option>> | null): void;
   useSession: VueUseSession<Option>;
   $Infer: {
     Session: NonNullable<ClientSession<Option>>;

package/dist/cookies/cache.mjs

@@ -1,4 +1,5 @@
 import { sessionSchema, userSchema } from "@better-auth/core/db";
+import { logger } from "@better-auth/core/env";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import * as z from "zod";
 //#region src/cookies/cache.ts
@@ -14,8 +15,15 @@ const compactCookieCacheSchema = z.object({
 	signature: z.string()
 });
 function parseCookieCachePayload(value) {
-	const result = cookieCachePayloadSchema.safeParse(safeJSONParse(value));
-	return result.success ? result.data : null;
+	const parsed = safeJSONParse(value);
+	if (parsed === null) return null;
+	const result = cookieCachePayloadSchema.safeParse(parsed);
+	if (result.success) return result.data;
+	logger.warn("Cookie cache payload failed schema validation", { issues: result.error.issues.map(({ code, path }) => ({
+		code,
+		path
+	})) });
+	return null;
 }
 function parseCompactCookieCache(value) {
 	const result = compactCookieCacheSchema.safeParse(value);

package/dist/db/get-migration.mjs

@@ -103,7 +103,20 @@ function databaseValueIsTrue(value) {
 	if (typeof value === "number") return value !== 0;
 	return value === "1" || value?.toLowerCase() === "true" || value === "t";
 }
-async function getDatabaseIndexes(db, dbType, schemaName) {
+function toDatabaseIndexMap(indexes) {
+	return new Map(indexes.map((index) => {
+		const columns = [...index.columns].sort((left, right) => left.position - right.position);
+		return [createDatabaseIndexKey(index.table, index.name), {
+			columns: columns.flatMap((column) => column.name === null ? [] : [column.name]),
+			name: index.name,
+			table: index.table,
+			unique: index.unique,
+			validFullColumns: index.valid && !index.partial && columns.length > 0 && columns.every((column) => column.name !== null && column.fullLength)
+		}];
+	}));
+}
+async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspectIndexes) {
+	if (introspectIndexes) return toDatabaseIndexMap(await introspectIndexes(tableNames));
 	let rows;
 	if (dbType === "sqlite") rows = (await sql`
 				SELECT
@@ -151,7 +164,8 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 					column_name AS columnName,
 					non_unique AS nonUnique,
 					seq_in_index AS columnPosition,
-					sub_part AS prefixLength
+					sub_part AS prefixLength,
+					COALESCE(LOWER(comment) = 'disabled', FALSE) AS isDisabled
 				FROM information_schema.statistics
 				WHERE table_schema = DATABASE()
 			`.execute(db)).rows;
@@ -180,7 +194,7 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 					AND indexes.name IS NOT NULL
 					AND index_columns.key_ordinal > 0
 			`.execute(db)).rows;
-	const indexRows = /* @__PURE__ */ new Map();
+	const indexMetadata = /* @__PURE__ */ new Map();
 	for (const row of rows) {
 		const table = row.tableName ?? row.table_name ?? row.TABLE_NAME ?? row.tablename ?? row.tbl_name;
 		const name = row.indexName ?? row.index_name ?? row.INDEX_NAME ?? row.name;
@@ -190,28 +204,29 @@ async function getDatabaseIndexes(db, dbType, schemaName) {
 		const nonUnique = row.nonUnique ?? row.non_unique ?? row.NON_UNIQUE;
 		const unique = nonUnique === void 0 ? databaseValueIsTrue(row.isUnique ?? row.is_unique) : !databaseValueIsTrue(nonUnique);
 		const position = Number(row.columnPosition ?? row.column_position ?? row.keyOrdinal ?? row.key_ordinal ?? row.ordinality ?? row.seqInIndex ?? row.seq_in_index ?? row.SEQ_IN_INDEX ?? row.seqno ?? 0);
-		const index = indexRows.get(key) ?? {
-			columns: [],
+		const indexColumn = {
+			fullLength: column !== void 0 && column !== null && (row.prefixLength === void 0 || row.prefixLength === null),
+			name: column ?? null,
+			position
+		};
+		const partial = databaseValueIsTrue(row.isPartial);
+		const valid = !databaseValueIsTrue(row.isDisabled) && !databaseValueIsTrue(row.isHypothetical) && (row.isValid === void 0 || databaseValueIsTrue(row.isValid));
+		const existing = indexMetadata.get(key);
+		indexMetadata.set(key, existing ? {
+			...existing,
+			columns: [...existing.columns, indexColumn],
+			partial: existing.partial || partial,
+			valid: existing.valid && valid
+		} : {
+			columns: [indexColumn],
 			name,
+			partial,
 			table,
 			unique,
-			validFullColumns: true
-		};
-		if (column) index.columns.push({
-			name: column,
-			position
+			valid
 		});
-		else index.validFullColumns = false;
-		if (databaseValueIsTrue(row.isPartial) || databaseValueIsTrue(row.isDisabled) || databaseValueIsTrue(row.isHypothetical) || row.isValid !== void 0 && !databaseValueIsTrue(row.isValid) || row.prefixLength !== void 0 && row.prefixLength !== null) index.validFullColumns = false;
-		indexRows.set(key, index);
 	}
-	return new Map([...indexRows].map(([key, index]) => [key, {
-		columns: index.columns.sort((left, right) => left.position - right.position).map((column) => column.name),
-		name: index.name,
-		table: index.table,
-		unique: index.unique,
-		validFullColumns: index.validFullColumns
-	}]));
+	return toDatabaseIndexMap([...indexMetadata.values()]);
 }
 async function getDatabaseColumnBounds(db, dbType, schemaName) {
 	if (dbType !== "mysql" && dbType !== "mssql") return /* @__PURE__ */ new Map();
@@ -353,7 +368,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		if (throwOnUnsafe) throw new UnsafeMigrationError(message);
 		unsafeChanges.push(message);
 	};
-	let { kysely: db, databaseType: dbType } = await createKyselyAdapter(config);
+	let { kysely: db, databaseType: dbType, introspectIndexes } = await createKyselyAdapter(config);
 	if (!dbType) {
 		logger.warn("Could not determine database type, defaulting to sqlite. Please provide a type in the database options to avoid this.");
 		dbType = "sqlite";
@@ -378,7 +393,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		}
 	} else if (dbType === "mssql") logger.debug(`SQL Server migration: Using schema '${currentSchema}' (from the current user's default schema)`);
 	const allTableMetadata = await db.introspection.getTables();
-	const databaseIndexes = await getDatabaseIndexes(db, dbType, currentSchema);
+	const databaseIndexMap = await getDatabaseIndexMap(db, dbType, currentSchema, allTableMetadata.map((table) => table.name), introspectIndexes);
 	const databaseColumnBounds = await getDatabaseColumnBounds(db, dbType, currentSchema);
 	let tableMetadata = allTableMetadata;
 	if (dbType === "postgres") try {
@@ -405,13 +420,13 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		for (const index of value.indexes ?? []) {
 			const name = index.name;
 			const indexKey = createDatabaseIndexKey(key, name);
-			const existingIndex = databaseIndexes.get(indexKey);
+			const existingIndex = databaseIndexMap.get(indexKey);
 			if (existingIndex) {
 				if (!databaseIndexMatches(existingIndex, index)) throw new BetterAuthError(`Database index "${name}" on table "${key}" does not match the configured fields and uniqueness. Rename or replace the existing index, then run the migration again.`);
 				continue;
 			}
 			if (dbType === "sqlite" || dbType === "postgres") {
-				const indexOnAnotherTable = [...databaseIndexes.values()].find((databaseIndex) => getPortableDatabaseIdentifierKey(databaseIndex.name) === getPortableDatabaseIdentifierKey(name) && getPortableDatabaseIdentifierKey(databaseIndex.table) !== getPortableDatabaseIdentifierKey(key));
+				const indexOnAnotherTable = [...databaseIndexMap.values()].find((databaseIndex) => getPortableDatabaseIdentifierKey(databaseIndex.name) === getPortableDatabaseIdentifierKey(name) && getPortableDatabaseIdentifierKey(databaseIndex.table) !== getPortableDatabaseIdentifierKey(key));
 				if (indexOnAnotherTable) throw new BetterAuthError(`Database index name "${name}" is already used by table "${indexOnAnotherTable.table}". Index names must be unique across the schema.`);
 			}
 			const plannedIndex = plannedIndexes.get(indexKey);

package/dist/db/internal-adapter.mjs

@@ -3,7 +3,7 @@ import { getDate } from "../utils/date.mjs";
 import { assertValidUserInfo, assertValidUserInfoSource } from "../utils/validate-user-info.mjs";
 import { getStorageOption, processIdentifier } from "./verification-token-storage.mjs";
 import { getWithHooks } from "./with-hooks.mjs";
-import { getCurrentAdapter, getCurrentAuthContext, queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
+import { getCurrentAdapter, getCurrentAuthEndpointContext, queueAfterTransactionHook, runWithTransaction, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
@@ -153,7 +153,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				assertValidUserInfoSource(validationSource);
 				let endpointContext;
 				try {
-					endpointContext = await getCurrentAuthContext();
+					endpointContext = getCurrentAuthEndpointContext();
 				} catch (error) {
 					logger.error("Unable to run validateUserInfo: missing endpoint context", error);
 					throw new APIError("FORBIDDEN", {
@@ -247,7 +247,7 @@ const createInternalAdapter = (adapter, ctx) => {
 		},
 		createSession: async (userId, dontRememberMe, override, overrideAll, storageOptions) => {
 			const headers = await (async () => {
-				const ctx = await getCurrentAuthContext().catch(() => null);
+				const ctx = tryGetCurrentAuthEndpointContext();
 				return ctx?.headers || ctx?.request?.headers;
 			})();
 			const storeInDb = options.session?.storeSessionInDatabase;

package/dist/db/with-hooks.mjs

@@ -1,10 +1,10 @@
-import { getCurrentAdapter, getCurrentAuthContext, queueAfterTransactionHook } from "@better-auth/core/context";
+import { getCurrentAdapter, queueAfterTransactionHook, tryGetCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { ATTR_CONTEXT, ATTR_DB_COLLECTION_NAME, ATTR_HOOK_TYPE, withSpan } from "@better-auth/core/instrumentation";
 //#region src/db/with-hooks.ts
 function getWithHooks(adapter, ctx) {
 	const hooksEntries = ctx.hooks;
 	async function createWithHooks(data, model, customCreateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.create?.before;
@@ -41,7 +41,7 @@ function getWithHooks(adapter, ctx) {
 		return created;
 	}
 	async function updateWithHooks(data, where, model, customUpdateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.update?.before;
@@ -77,7 +77,7 @@ function getWithHooks(adapter, ctx) {
 		return updated;
 	}
 	async function updateManyWithHooks(data, where, model, customUpdateFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let actualData = data;
 		for (const { source, hooks } of hooksEntries) {
 			const toRun = hooks[model]?.update?.before;
@@ -113,7 +113,7 @@ function getWithHooks(adapter, ctx) {
 		return updated;
 	}
 	async function deleteWithHooks(where, model, customDeleteFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let entityToDelete = null;
 		try {
 			entityToDelete = (await (await getCurrentAdapter(adapter)).findMany({
@@ -150,7 +150,7 @@ function getWithHooks(adapter, ctx) {
 		return deleted;
 	}
 	async function deleteManyWithHooks(where, model, customDeleteFn) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		let entitiesToDelete = [];
 		try {
 			entitiesToDelete = await (await getCurrentAdapter(adapter)).findMany({
@@ -202,7 +202,7 @@ function getWithHooks(adapter, ctx) {
 	* the helper resolves to `null` (no `consumeFn` call, no after hooks).
 	*/
 	async function consumeOneWithHooks(model, hookWhere, consumeFn, preSnapshot) {
-		const context = await getCurrentAuthContext().catch(() => null);
+		const context = tryGetCurrentAuthEndpointContext();
 		const beforeHooks = hooksEntries.flatMap(({ source, hooks }) => {
 			const fn = hooks[model]?.delete?.before;
 			return fn ? [{

package/dist/index.mjs

@@ -2,6 +2,7 @@ import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProt
 import { generateGenericState, parseGenericState } from "./state.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
+import "./utils/index.mjs";
 import { APIError } from "./api/index.mjs";
 import { betterAuth } from "./auth/full.mjs";
 import { getCurrentAdapter } from "@better-auth/core/context";

package/dist/oauth2/errors.mjs

@@ -1,3 +1,4 @@
+import { appendQueryParams } from "@better-auth/core/utils/url";
 //#region src/oauth2/errors.ts
 /**
 * Error codes used in OAuth callback redirects (`?error=<code>`). These are
@@ -33,8 +34,8 @@ const HANDLING_DOCS_URL = "https://www.better-auth.com/docs/concepts/oauth#handl
 function redirectOnError(ctx, errorURL, error, description) {
 	const params = new URLSearchParams({ error });
 	if (description) params.set("error_description", description);
-	const sep = errorURL.includes("?") ? "&" : "?";
-	throw ctx.redirect(`${errorURL}${sep}${params.toString()}`);
+	const redirectURL = appendQueryParams(errorURL, params);
+	throw ctx.redirect(redirectURL);
 }
 /**
 * Build the logger message shown when an OAuth provider does not return an
@@ -42,7 +43,7 @@ function redirectOnError(ctx, errorURL, error, description) {
 * the same workaround docs.
 */
 function missingEmailLogMessage(providerId, options) {
-	return `${options?.source === "generic" ? `Generic OAuth provider "${providerId}"` : `Provider "${providerId}"`} did not return an email${options?.source === "id_token" ? " in the id token" : ""}. Either request the provider's email scope, or synthesize one via \`mapProfileToUser\`. See ${HANDLING_DOCS_URL}`;
+	return `${options?.source === "generic" ? `Generic OAuth provider "${providerId}"` : `Provider "${providerId}"`} did not return an email${options?.source === "id_token" ? " in the id token" : ""}. Either request the provider's email scope, or create a placeholder via \`mapProfileToUser\`. See ${HANDLING_DOCS_URL}`;
 }
 //#endregion
 export { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage, redirectOnError };

package/dist/oauth2/state.mjs

@@ -55,7 +55,7 @@ async function parseState(c) {
 		let redirectErrorURL = errorURL;
 		if (error instanceof StateError) {
 			code = error.code === "state_security_mismatch" ? "state_mismatch" : error.code;
-			redirectErrorURL = error.errorURL ?? errorURL;
+			redirectErrorURL = error.errorURL || errorURL;
 		}
 		redirectOnError(c, redirectErrorURL, code);
 	}

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.1";
+var version = "1.7.2";
 //#endregion
 export { version };

package/dist/plugins/admin/routes.mjs

@@ -534,7 +534,7 @@ const banUser = (opts) => createAuthEndpoint("/admin/ban-user", {
 	const user = await ctx.context.internalAdapter.updateUser(ctx.body.userId, {
 		banned: true,
 		banReason: ctx.body.banReason || opts?.defaultBanReason || "No reason",
-		banExpires: ctx.body.banExpiresIn ? getDate(ctx.body.banExpiresIn, "sec") : opts?.defaultBanExpiresIn ? getDate(opts.defaultBanExpiresIn, "sec") : void 0,
+		banExpires: ctx.body.banExpiresIn ? getDate(ctx.body.banExpiresIn, "sec") : opts?.defaultBanExpiresIn ? getDate(opts.defaultBanExpiresIn, "sec") : null,
 		updatedAt: /* @__PURE__ */ new Date()
 	});
 	await ctx.context.internalAdapter.deleteUserSessions(ctx.body.userId);

package/dist/plugins/anonymous/index.mjs

@@ -10,6 +10,7 @@ import { schema } from "./schema.mjs";
 import { generateId } from "@better-auth/core/utils/id";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/anonymous/index.ts
 /**
 * Resolves the anonymous session being upgraded during an account-link callback.
@@ -51,7 +52,10 @@ async function getAnonUserEmail(options) {
 	}
 	const id = generateId();
 	if (options?.emailDomainName) return `temp-${id}@${options.emailDomainName}`;
-	return `temp@${id}.com`;
+	return createPlaceholderEmail({
+		identifier: id,
+		namespace: "anonymous"
+	});
 }
 const anonymous = (options) => {
 	return {

package/dist/plugins/anonymous/types.d.mts

@@ -18,9 +18,8 @@ interface UserWithAnonymous extends User {
 }
 interface AnonymousOptions {
   /**
-   * Configure the domain name of the temporary email
-   * address for anonymous users in the database.
-   * @default "baseURL"
+   * Configure a custom domain for anonymous user email addresses.
+   * @default "anonymous.placeholder.invalid"
    */
   emailDomainName?: string | undefined;
   /**

package/dist/plugins/generic-oauth/providers/microsoft-entra-id.mjs

@@ -1,5 +1,6 @@
 import { decodeJwt } from "jose";
 import { betterFetch } from "@better-fetch/fetch";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/generic-oauth/providers/microsoft-entra-id.ts
 function getMicrosoftProfileName(profile) {
 	return profile.name ?? (`${profile.given_name ?? profile.givenname ?? ""} ${profile.family_name ?? profile.familyname ?? ""}`.trim() || void 0);
@@ -46,25 +47,34 @@ function microsoftEntraId(options) {
 		} catch {
 			return null;
 		}
-		if (!(typeof tokenProfile.oid === "string" && tokenProfile.oid.trim().length > 0 ? tokenProfile.oid : void 0)) return null;
+		const oid = typeof tokenProfile.oid === "string" && tokenProfile.oid.trim().length > 0 ? tokenProfile.oid : void 0;
+		if (!oid) return null;
+		const tokenEmail = tokenProfile.email;
 		const tokenUserInfo = {
 			...tokenProfile,
 			name: getMicrosoftProfileName(tokenProfile),
-			email: tokenProfile.email ?? tokenProfile.preferred_username ?? void 0,
+			email: tokenEmail ?? createPlaceholderEmail({
+				identifier: oid,
+				namespace: "microsoft-entra-id"
+			}),
 			image: tokenProfile.picture,
-			emailVerified: tokenProfile.email_verified ?? false
+			emailVerified: tokenEmail ? tokenProfile.email_verified ?? false : false
 		};
 		if (!tokens.accessToken) return tokenUserInfo;
 		const { data: profile, error } = await betterFetch(userInfoUrl, { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
 		if (error || !profile) return tokenUserInfo;
 		if (typeof tokenProfile.sub !== "string" || profile.sub !== tokenProfile.sub) return tokenUserInfo;
+		const emailClaim = tokenProfile.email ?? profile.email;
 		return {
 			...profile,
 			...tokenProfile,
 			name: getMicrosoftProfileName(tokenProfile) ?? getMicrosoftProfileName(profile),
-			email: tokenProfile.email ?? profile.email ?? tokenProfile.preferred_username ?? profile.preferred_username ?? void 0,
+			email: emailClaim ?? createPlaceholderEmail({
+				identifier: oid,
+				namespace: "microsoft-entra-id"
+			}),
 			image: tokenProfile.picture ?? profile.picture,
-			emailVerified: tokenProfile.email_verified ?? profile.email_verified ?? false
+			emailVerified: emailClaim != null ? tokenProfile.email_verified ?? profile.email_verified ?? false : false
 		};
 	};
 	return {

package/dist/plugins/haveibeenpwned/index.mjs

@@ -1,7 +1,7 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
-import { getCurrentAuthContext } from "@better-auth/core/context";
+import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { defineErrorCodes } from "@better-auth/core/utils/error-codes";
 import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
@@ -46,7 +46,7 @@ const haveIBeenPwned = (options) => {
 				...ctx.password,
 				async hash(password) {
 					if (options?.enabled === false) return originalHash(password);
-					const c = await getCurrentAuthContext();
+					const c = getCurrentAuthEndpointContext();
 					if (!c.path || !paths.includes(c.path)) return originalHash(password);
 					await checkPasswordCompromise(password, options?.customPasswordCompromisedMessage);
 					return originalHash(password);

package/dist/plugins/jwt/verify.mjs

@@ -1,5 +1,5 @@
 import { getJwksAdapter } from "./adapter.mjs";
-import { getCurrentAuthContext } from "@better-auth/core/context";
+import { getCurrentAuthEndpointContext } from "@better-auth/core/context";
 import { base64 } from "@better-auth/utils/base64";
 import { importJWK, jwtVerify } from "jose";
 //#region src/plugins/jwt/verify.ts
@@ -8,7 +8,7 @@ import { importJWK, jwtVerify } from "jose";
 * Returns the payload if valid, null otherwise
 */
 async function verifyJWT(token, options) {
-	const ctx = await getCurrentAuthContext();
+	const ctx = getCurrentAuthEndpointContext();
 	try {
 		const parts = token.split(".");
 		if (parts.length !== 3) return null;

package/dist/plugins/open-api/index.mjs

@@ -1,4 +1,5 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import "../../utils/index.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { generator } from "./generator.mjs";

package/dist/plugins/phone-number/routes.mjs

@@ -4,6 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import "../../utils/index.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";

package/dist/plugins/siwe/index.mjs

@@ -1,5 +1,4 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
-import { getOrigin } from "../../utils/url.mjs";
 import { mergeSchema } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { APIError } from "../../api/index.mjs";
@@ -10,6 +9,7 @@ import { schema } from "./schema.mjs";
 import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/siwe/index.ts
 const signedWalletAddressSchema = z.string().regex(/^0x[a-fA-F0-9]{40}$/).length(42);
 const SIWE_VERIFICATION_IDENTIFIER_PREFIX = "siwe:";
@@ -162,9 +162,11 @@ const siwe = (options) => {
 						});
 					}
 					if (!user) {
-						const domain = options.emailDomainName ?? getOrigin(ctx.context.baseURL);
 						const normalizedEmail = email?.toLowerCase();
-						const walletEmail = `${walletAddress}@${domain}`;
+						const walletEmail = options.emailDomainName ? `${walletAddress}@${options.emailDomainName}` : createPlaceholderEmail({
+							identifier: walletAddress,
+							namespace: "siwe"
+						});
 						let userEmail = walletEmail;
 						let emailClaimIdentifier;
 						if (!isAnon && normalizedEmail) {

package/dist/test-utils/http-test-instance.d.mts

@@ -61,7 +61,7 @@ declare function getHttpTestInstance<O extends Partial<BetterAuthOptions>, C ext
   port: number;
   auth: Auth<O>;
   client: {
-    hydrateSession: (session: null) => void;
+    hydrateSession(session: null): void;
     useSession: _$nanostores.Atom<{
       data: never;
       error: _$_better_fetch_fetch0.BetterFetchError | null;

package/dist/test-utils/test-instance.mjs

@@ -7,7 +7,7 @@ import { createAuthClient } from "../client/vanilla.mjs";
 import { bearer } from "../plugins/bearer/index.mjs";
 import { sql } from "kysely";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { afterAll } from "vitest";
 //#region src/test-utils/test-instance.ts
 const cleanupSet = /* @__PURE__ */ new Set();
@@ -18,6 +18,17 @@ afterAll(async () => {
 		cleanupSet.delete(cleanup);
 	}
 });
+const TEST_PASSWORD_HASH_PREFIX = "$test$sha256$";
+/**
+* Intentionally fast for tests
+*/
+function createTestPasswordHash(password) {
+	return `${TEST_PASSWORD_HASH_PREFIX}${createHash("sha256").update(password.normalize("NFKC")).digest("hex")}`;
+}
+const testPassword = {
+	hash: async (password) => createTestPasswordHash(password),
+	verify: async ({ hash, password }) => hash === createTestPasswordHash(password)
+};
 async function getTestInstance(options, config) {
 	const testWith = config?.testWith || "sqlite";
 	const postgresSchema = testWith === "postgres" ? `ba_test_${randomUUID().replaceAll("-", "_")}` : void 0;
@@ -83,6 +94,11 @@ async function getTestInstance(options, config) {
 		baseURL: "http://localhost:" + (config?.port || 3e3),
 		...opts,
 		...options,
+		emailAndPassword: {
+			...opts.emailAndPassword,
+			...options?.emailAndPassword,
+			password: options?.emailAndPassword?.password ?? testPassword
+		},
 		plugins: [bearer(), ...options?.plugins || []]
 	});
 	const testUser = {

package/dist/utils/index.mjs

@@ -0,0 +1,5 @@
+import "./url.mjs";
+import "../state.mjs";
+import "../oauth2/state.mjs";
+import "./hide-metadata.mjs";
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -473,13 +473,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.3.6",
-    "@better-auth/core": "1.7.1",
-    "@better-auth/drizzle-adapter": "1.7.1",
-    "@better-auth/kysely-adapter": "1.7.1",
-    "@better-auth/memory-adapter": "1.7.1",
-    "@better-auth/mongo-adapter": "1.7.1",
-    "@better-auth/prisma-adapter": "1.7.1",
-    "@better-auth/telemetry": "1.7.1"
+    "@better-auth/core": "1.7.2",
+    "@better-auth/drizzle-adapter": "1.7.2",
+    "@better-auth/kysely-adapter": "1.7.2",
+    "@better-auth/memory-adapter": "1.7.2",
+    "@better-auth/mongo-adapter": "1.7.2",
+    "@better-auth/prisma-adapter": "1.7.2",
+    "@better-auth/telemetry": "1.7.2"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -504,7 +504,7 @@
     "tsdown": "0.21.10",
     "type-fest": "^5.7.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.0.18",
+    "vitest": "^4.1.10",
     "vue": "^3.5.29"
   },
   "peerDependencies": {