better-auth 1.7.1 → 1.7.3

package/dist/plugins/siwe/index.mjs

@@ -1,5 +1,4 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
-import { getOrigin } from "../../utils/url.mjs";
 import { mergeSchema } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { APIError } from "../../api/index.mjs";
@@ -7,9 +6,9 @@ import { PACKAGE_VERSION } from "../../version.mjs";
 import { toChecksumAddress } from "../../utils/hashing.mjs";
 import { normalizeSiweDomain, parseSiweMessage } from "./parse-message.mjs";
 import { schema } from "./schema.mjs";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
+import { createPlaceholderEmail } from "@better-auth/core/utils/email";
 //#region src/plugins/siwe/index.ts
 const signedWalletAddressSchema = z.string().regex(/^0x[a-fA-F0-9]{40}$/).length(42);
 const SIWE_VERIFICATION_IDENTIFIER_PREFIX = "siwe:";
@@ -162,9 +161,11 @@ const siwe = (options) => {
 						});
 					}
 					if (!user) {
-						const domain = options.emailDomainName ?? getOrigin(ctx.context.baseURL);
 						const normalizedEmail = email?.toLowerCase();
-						const walletEmail = `${walletAddress}@${domain}`;
+						const walletEmail = options.emailDomainName ? `${walletAddress}@${options.emailDomainName}` : createPlaceholderEmail({
+							identifier: walletAddress,
+							namespace: "siwe"
+						});
 						let userEmail = walletEmail;
 						let emailClaimIdentifier;
 						if (!isAnon && normalizedEmail) {
@@ -213,7 +214,6 @@ const siwe = (options) => {
 						await ctx.context.internalAdapter.createAccount({
 							userId: user.id,
 							providerId: "siwe",
-							issuer: createLocalAccountIssuer("siwe"),
 							accountId: `${walletAddress}:${chainId}`,
 							createdAt: /* @__PURE__ */ new Date(),
 							updatedAt: /* @__PURE__ */ new Date()
@@ -232,7 +232,6 @@ const siwe = (options) => {
 						await ctx.context.internalAdapter.createAccount({
 							userId: user.id,
 							providerId: "siwe",
-							issuer: createLocalAccountIssuer("siwe"),
 							accountId: `${walletAddress}:${chainId}`,
 							createdAt: /* @__PURE__ */ new Date(),
 							updatedAt: /* @__PURE__ */ new Date()

package/dist/plugins/two-factor/client.d.mts

@@ -61,6 +61,7 @@ declare const twoFactorClient: (options?: {
     OTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_NOT_CONFIGURED">;
     OTP_HAS_EXPIRED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_HAS_EXPIRED">;
     TOTP_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_ENABLED">;
+    TOTP_ALREADY_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_ALREADY_ENABLED">;
     TOTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_CONFIGURED">;
     TWO_FACTOR_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TWO_FACTOR_NOT_ENABLED">;
     BACKUP_CODES_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"BACKUP_CODES_NOT_ENABLED">;

package/dist/plugins/two-factor/error-code.d.mts

@@ -6,6 +6,7 @@ declare const TWO_FACTOR_ERROR_CODES: {
   OTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_NOT_CONFIGURED">;
   OTP_HAS_EXPIRED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_HAS_EXPIRED">;
   TOTP_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_ENABLED">;
+  TOTP_ALREADY_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_ALREADY_ENABLED">;
   TOTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_CONFIGURED">;
   TWO_FACTOR_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TWO_FACTOR_NOT_ENABLED">;
   BACKUP_CODES_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"BACKUP_CODES_NOT_ENABLED">;

package/dist/plugins/two-factor/error-code.mjs

@@ -5,6 +5,7 @@ const TWO_FACTOR_ERROR_CODES = defineErrorCodes({
 	OTP_NOT_CONFIGURED: "OTP is not available",
 	OTP_HAS_EXPIRED: "OTP has expired",
 	TOTP_NOT_ENABLED: "TOTP not enabled",
+	TOTP_ALREADY_ENABLED: "TOTP is already enabled",
 	TOTP_NOT_CONFIGURED: "TOTP is not available",
 	TWO_FACTOR_NOT_ENABLED: "Two factor isn't enabled",
 	BACKUP_CODES_NOT_ENABLED: "Backup codes aren't enabled",

package/dist/plugins/two-factor/index.d.mts

@@ -705,6 +705,7 @@ declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
     OTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_NOT_CONFIGURED">;
     OTP_HAS_EXPIRED: _$_better_auth_core_utils_error_codes0.RawError<"OTP_HAS_EXPIRED">;
     TOTP_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_ENABLED">;
+    TOTP_ALREADY_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_ALREADY_ENABLED">;
     TOTP_NOT_CONFIGURED: _$_better_auth_core_utils_error_codes0.RawError<"TOTP_NOT_CONFIGURED">;
     TWO_FACTOR_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"TWO_FACTOR_NOT_ENABLED">;
     BACKUP_CODES_NOT_ENABLED: _$_better_auth_core_utils_error_codes0.RawError<"BACKUP_CODES_NOT_ENABLED">;

package/dist/plugins/two-factor/index.mjs

@@ -122,7 +122,6 @@ const twoFactor = (options) => {
 					await ctx.context.internalAdapter.deleteSession(ctx.context.session.session.token);
 					return ctx.json({ method: "otp" });
 				}
-				const backupCodes = await generateBackupCodes(ctx.context.secretConfig, backupCodeOptions);
 				const existingTwoFactor = await ctx.context.adapter.findOne({
 					model: opts.twoFactorTable,
 					where: [{
@@ -130,6 +129,8 @@ const twoFactor = (options) => {
 						value: user.id
 					}]
 				});
+				if (existingTwoFactor && existingTwoFactor.verified !== false) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_ALREADY_ENABLED);
+				const backupCodes = await generateBackupCodes(ctx.context.secretConfig, backupCodeOptions);
 				const secret = generateRandomString(32);
 				const encryptedSecret = await symmetricEncrypt({
 					key: ctx.context.secretConfig,
@@ -146,7 +147,7 @@ const twoFactor = (options) => {
 				const totpData = {
 					secret: encryptedSecret,
 					backupCodes: backupCodes.encryptedBackupCodes,
-					verified: existingTwoFactor != null && existingTwoFactor.verified === true || !!options?.skipVerificationOnEnable
+					verified: !!options?.skipVerificationOnEnable
 				};
 				if (existingTwoFactor) await ctx.context.adapter.update({
 					model: opts.twoFactorTable,

package/dist/state.d.mts

@@ -9,26 +9,13 @@ declare const stateDataSchema: z.ZodObject<{
   errorURL: z.ZodOptional<z.ZodString>;
   newUserURL: z.ZodOptional<z.ZodString>;
   expiresAt: z.ZodNumber;
-  /**
-   * CSRF nonce returned to the OAuth provider. When using cookie state storage,
-   * this must match the callback `state` query parameter.
-   */
   oauthState: z.ZodOptional<z.ZodString>;
   link: z.ZodOptional<z.ZodObject<{
     email: z.ZodString;
     userId: z.ZodCoercedString<unknown>;
   }, z.core.$strip>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
-  /**
-   * OIDC nonce sent as the authorization request `nonce` parameter when the
-   * provider requires an ID token to be bound to this redirect flow.
-   */
   idTokenNonce: z.ZodOptional<z.ZodString>;
-  /**
-   * Server-controlled values that ride the state across the provider redirect.
-   * Populated only by `generateState` from `addOAuthServerContext`, never from
-   * the request body, so it is safe to trust on the callback.
-   */
   serverContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$loose>;
 type StateData = z.infer<typeof stateDataSchema>;

package/dist/test-utils/http-test-instance.d.mts

@@ -61,7 +61,7 @@ declare function getHttpTestInstance<O extends Partial<BetterAuthOptions>, C ext
   port: number;
   auth: Auth<O>;
   client: {
-    hydrateSession: (session: null) => void;
+    hydrateSession(session: null): void;
     useSession: _$nanostores.Atom<{
       data: never;
       error: _$_better_fetch_fetch0.BetterFetchError | null;

package/dist/test-utils/test-instance.mjs

@@ -7,7 +7,7 @@ import { createAuthClient } from "../client/vanilla.mjs";
 import { bearer } from "../plugins/bearer/index.mjs";
 import { sql } from "kysely";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { afterAll } from "vitest";
 //#region src/test-utils/test-instance.ts
 const cleanupSet = /* @__PURE__ */ new Set();
@@ -18,6 +18,17 @@ afterAll(async () => {
 		cleanupSet.delete(cleanup);
 	}
 });
+const TEST_PASSWORD_HASH_PREFIX = "$test$sha256$";
+/**
+* Intentionally fast for tests
+*/
+function createTestPasswordHash(password) {
+	return `${TEST_PASSWORD_HASH_PREFIX}${createHash("sha256").update(password.normalize("NFKC")).digest("hex")}`;
+}
+const testPassword = {
+	hash: async (password) => createTestPasswordHash(password),
+	verify: async ({ hash, password }) => hash === createTestPasswordHash(password)
+};
 async function getTestInstance(options, config) {
 	const testWith = config?.testWith || "sqlite";
 	const postgresSchema = testWith === "postgres" ? `ba_test_${randomUUID().replaceAll("-", "_")}` : void 0;
@@ -79,12 +90,25 @@ async function getTestInstance(options, config) {
 		advanced: { cookies: {} },
 		logger: { level: "debug" }
 	};
-	const auth = betterAuth({
+	const authOptions = {
 		baseURL: "http://localhost:" + (config?.port || 3e3),
 		...opts,
 		...options,
+		emailAndPassword: {
+			...opts.emailAndPassword,
+			...options?.emailAndPassword,
+			password: options?.emailAndPassword?.password ?? testPassword
+		},
 		plugins: [bearer(), ...options?.plugins || []]
-	});
+	};
+	if (testWith !== "mongodb") {
+		const { runMigrations } = await getMigrations({
+			...authOptions,
+			database: opts.database
+		});
+		await runMigrations();
+	}
+	const auth = betterAuth(authOptions);
 	const testUser = {
 		email: "test@test.com",
 		password: "test123456",
@@ -101,13 +125,6 @@ async function getTestInstance(options, config) {
 			headers
 		});
 	}
-	if (testWith !== "mongodb") {
-		const { runMigrations } = await getMigrations({
-			...auth.options,
-			database: opts.database
-		});
-		await runMigrations();
-	}
 	await createTestUser();
 	const cleanup = async () => {
 		if (testWith === "mongodb") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.1",
+  "version": "1.7.3",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -472,14 +472,14 @@
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
-    "zod": "^4.3.6",
-    "@better-auth/core": "1.7.1",
-    "@better-auth/drizzle-adapter": "1.7.1",
-    "@better-auth/kysely-adapter": "1.7.1",
-    "@better-auth/memory-adapter": "1.7.1",
-    "@better-auth/mongo-adapter": "1.7.1",
-    "@better-auth/prisma-adapter": "1.7.1",
-    "@better-auth/telemetry": "1.7.1"
+    "zod": "^4.5.4",
+    "@better-auth/core": "1.7.3",
+    "@better-auth/drizzle-adapter": "1.7.3",
+    "@better-auth/kysely-adapter": "1.7.3",
+    "@better-auth/memory-adapter": "1.7.3",
+    "@better-auth/mongo-adapter": "1.7.3",
+    "@better-auth/prisma-adapter": "1.7.3",
+    "@better-auth/telemetry": "1.7.3"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -504,7 +504,7 @@
     "tsdown": "0.21.10",
     "type-fest": "^5.7.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.0.18",
+    "vitest": "^4.1.10",
     "vue": "^3.5.29"
   },
   "peerDependencies": {