better-auth 1.7.13 → 1.7.15

package/dist/api/dispatch.mjs

@@ -243,7 +243,7 @@ async function dispatchAuthEndpoint(endpoint, input) {
 		});
 		if (result instanceof Response) return result;
 		internalContext.context.returned = result.response;
-		internalContext.context.responseHeaders = result.headers ?? void 0;
+		mergeResponseHeaders(internalContext.context, result.headers);
 		const after = await runAfterHooks(internalContext, afterHooks, endpoint, operationId);
 		if (after.response !== void 0) result.response = after.response;
 		result.headers = after.headers ?? result.headers;

package/dist/client/parser.mjs

@@ -1,10 +1,4 @@
 //#region src/client/parser.ts
-const PROTO_POLLUTION_PATTERNS = {
-	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
-	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
-	protoShort: /"__proto__"\s*:/,
-	constructorShort: /"constructor"\s*:/
-};
 const JSON_SIGNATURE = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
 const SPECIAL_VALUES = {
 	true: true,
@@ -40,14 +34,10 @@ function betterJSONParse(value, options = {}) {
 		if (strict) throw new SyntaxError("[better-json] Invalid JSON");
 		return value;
 	}
-	if (Object.entries(PROTO_POLLUTION_PATTERNS).some(([key, pattern]) => {
-		const matches = pattern.test(trimmed);
-		if (matches && warnings) console.warn(`[better-json] Detected potential prototype pollution attempt using ${key} pattern`);
-		return matches;
-	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
 	try {
 		const secureReviver = (key, value) => {
 			if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+				if (strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
 				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
 				return;
 			}

package/dist/client/vue/index.mjs

@@ -1,3 +1,4 @@
+import { trimTrailingSlashes } from "../../utils/url.mjs";
 import { getClientConfig } from "../config.mjs";
 import { createDynamicPathProxy } from "../proxy.mjs";
 import { useStore } from "./vue-store.mjs";
@@ -16,18 +17,23 @@ function toHeadersInit(headers) {
 }
 function createAuthClient(options) {
 	const { baseURL, pluginPathMethods, pluginsActions, pluginsAtoms, hydrateSession, $sessionSignal, $fetch, $store, atomListeners } = getClientConfig(options, false);
-	const sessionCacheKey = [
-		"better-auth",
-		"session",
-		options?.baseURL || "inferred",
-		options?.basePath ?? "/api/auth"
-	].join(":");
+	const baseURLKey = options?.baseURL || "inferred";
+	const basePath = options?.basePath ?? "/api/auth";
+	const sessionCacheKey = `better-auth:session:${baseURLKey}:${basePath}`;
+	const sessionPath = trimTrailingSlashes(basePath.startsWith("/") ? basePath : `/${basePath}`);
+	/**
+	* Stays relative without an explicit `baseURL` so the SSR session fetch
+	* forwards the incoming cookies.
+	*
+	* @see https://nuxt.com/docs/4.x/getting-started/data-fetching
+	*/
+	const sessionURL = `${options?.baseURL ? baseURL : sessionPath}/get-session`;
 	const resolvedHooks = {};
 	for (const [key, value] of Object.entries(pluginsAtoms)) resolvedHooks[getAtomKey(key)] = () => useStore(value);
 	function useSession(useFetch) {
 		if (useFetch) {
 			const sessionSignal = useStore($sessionSignal);
-			return useFetch(`${baseURL}/get-session`, {
+			return useFetch(sessionURL, {
 				headers: toHeadersInit(options?.fetchOptions?.headers),
 				key: sessionCacheKey,
 				watch: [sessionSignal]

package/dist/context/secret-utils.mjs

@@ -12,12 +12,12 @@ function estimateEntropy(str) {
 }
 function parseSecretsEnv(envValue) {
 	if (!envValue) return null;
-	return envValue.split(",").map((entry) => {
+	return envValue.split(",").map((entry, index) => {
 		entry = entry.trim();
 		const colonIdx = entry.indexOf(":");
-		if (colonIdx === -1) throw new BetterAuthError(`Invalid BETTER_AUTH_SECRETS entry: "${entry}". Expected format: "<version>:<secret>"`);
+		if (colonIdx === -1) throw new BetterAuthError(`Invalid BETTER_AUTH_SECRETS entry at position ${index + 1}. Expected format: "<version>:<secret>"`);
 		const version = parseInt(entry.slice(0, colonIdx), 10);
-		if (!Number.isInteger(version) || version < 0) throw new BetterAuthError(`Invalid version in BETTER_AUTH_SECRETS: "${entry.slice(0, colonIdx)}". Version must be a non-negative integer.`);
+		if (!Number.isInteger(version) || version < 0) throw new BetterAuthError(`Invalid version in BETTER_AUTH_SECRETS entry at position ${index + 1}. Version must be a non-negative integer.`);
 		const value = entry.slice(colonIdx + 1).trim();
 		if (!value) throw new BetterAuthError(`Empty secret value for version ${version} in BETTER_AUTH_SECRETS.`);
 		return {

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.13";
+var version = "1.7.15";
 //#endregion
 export { version };

package/dist/plugins/admin/admin.d.mts

@@ -12,7 +12,7 @@ declare module "@better-auth/core" {
 export declare const admin: <O extends AdminOptions>(options?: O | undefined) => {
   id: "admin";
   version: string;
-  init(): {
+  init(authContext: import("@better-auth/core").AuthContext): {
     options: {
       databaseHooks: {
         user: {
@@ -863,6 +863,7 @@ export declare const admin: <O extends AdminOptions>(options?: O | undefined) =>
     INVALID_ROLE_TYPE: import("@better-auth/core/utils/error-codes").RawError<"INVALID_ROLE_TYPE">;
     YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
     PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
+    USER_ID_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"USER_ID_CANNOT_BE_UPDATED">;
   };
   schema: {
     user: {

package/dist/plugins/admin/admin.mjs

@@ -22,7 +22,7 @@ const admin = (options) => {
 	return {
 		id: "admin",
 		version: PACKAGE_VERSION,
-		init() {
+		init(authContext) {
 			return { options: { databaseHooks: {
 				user: { create: { async before(user) {
 					return { data: {
@@ -31,11 +31,11 @@ const admin = (options) => {
 					} };
 				} } },
 				session: { create: { async before(session, ctx) {
-					if (!ctx) return;
-					const user = await ctx.context.internalAdapter.findUserById(session.userId);
+					const internalAdapter = ctx?.context.internalAdapter ?? authContext.internalAdapter;
+					const user = await internalAdapter.findUserById(session.userId);
 					if (user?.banned) {
 						if (user.banExpires && new Date(user.banExpires).getTime() < Date.now()) {
-							await ctx.context.internalAdapter.updateUser(session.userId, {
+							await internalAdapter.updateUser(session.userId, {
 								banned: false,
 								banReason: null,
 								banExpires: null

package/dist/plugins/admin/client.d.mts

@@ -75,6 +75,7 @@ export declare const adminClient: <O extends AdminClientOptions>(options?: O | u
     INVALID_ROLE_TYPE: import("@better-auth/core/utils/error-codes").RawError<"INVALID_ROLE_TYPE">;
     YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
     PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
+    USER_ID_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"USER_ID_CANNOT_BE_UPDATED">;
   };
 };
 //#endregion

package/dist/plugins/admin/error-codes.d.mts

@@ -23,5 +23,6 @@ export declare const ADMIN_ERROR_CODES: {
   INVALID_ROLE_TYPE: import("@better-auth/core/utils/error-codes").RawError<"INVALID_ROLE_TYPE">;
   YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: import("@better-auth/core/utils/error-codes").RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">;
   PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: import("@better-auth/core/utils/error-codes").RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER">;
+  USER_ID_CANNOT_BE_UPDATED: import("@better-auth/core/utils/error-codes").RawError<"USER_ID_CANNOT_BE_UPDATED">;
 };
 //#endregion

package/dist/plugins/admin/error-codes.mjs

@@ -23,7 +23,8 @@ const ADMIN_ERROR_CODES = defineErrorCodes({
 	YOU_CANNOT_IMPERSONATE_ADMINS: "You cannot impersonate admins",
 	INVALID_ROLE_TYPE: "Invalid role type",
 	YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: "You are not allowed to update users email",
-	PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: "Password cannot be updated through update-user. Use the set-user-password endpoint instead"
+	PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: "Password cannot be updated through update-user. Use the set-user-password endpoint instead",
+	USER_ID_CANNOT_BE_UPDATED: "User id cannot be updated"
 });
 //#endregion
 export { ADMIN_ERROR_CODES };

package/dist/plugins/admin/routes.mjs

@@ -257,6 +257,7 @@ const adminUpdateUser = (opts) => createAuthEndpoint("/admin/update-user", {
 	const updateData = ctx.body.data;
 	const hasDataKey = (key) => Object.prototype.hasOwnProperty.call(updateData, key);
 	if (hasDataKey("password")) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER);
+	if (hasDataKey("id")) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.USER_ID_CANNOT_BE_UPDATED);
 	if (Object.prototype.hasOwnProperty.call(ctx.body.data, "role")) {
 		if (!hasPermission({
 			userId: ctx.context.session.user.id,

package/dist/plugins/generic-oauth/providers/hubspot.mjs

@@ -25,8 +25,11 @@ import { betterFetch } from "@better-fetch/fetch";
 function hubspot(options) {
 	const defaultScopes = ["oauth"];
 	const getUserInfo = async (tokens) => {
-		const tokenInfoUrl = `https://api.hubapi.com/oauth/v1/access-tokens/${tokens.accessToken}`;
-		const { data: profile, error } = await betterFetch(tokenInfoUrl, { headers: { "Content-Type": "application/json" } });
+		if (!tokens.accessToken) return null;
+		const { data: profile, error } = await betterFetch("https://api.hubapi.com/oauth/v1/access-tokens/:token", {
+			params: { token: tokens.accessToken },
+			headers: { "Content-Type": "application/json" }
+		});
 		if (error || !profile) return null;
 		const id = profile.user_id ?? profile.signed_access_token?.userId;
 		if (!id) return null;

package/dist/plugins/two-factor/totp/index.mjs

@@ -9,7 +9,18 @@ import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
 import { createOTP } from "@better-auth/utils/otp";
+import { base32 } from "@better-auth/utils/base32";
 //#region src/plugins/two-factor/totp/index.ts
+const BASE32_PREFIX = "base32:";
+/**
+* Secrets imported from other providers are stored as `base32:<secret>`.
+* Generated secrets never contain `:`, so they are used as-is.
+*/
+async function decryptTOTPSecret(options) {
+	const secret = await symmetricDecrypt(options);
+	if (!secret.startsWith(BASE32_PREFIX)) return secret;
+	return base32.decode(secret.slice(7).toUpperCase());
+}
 const generateTOTPBodySchema = z.object({ secret: z.string().meta({ description: "The secret to generate the TOTP code" }) });
 const verifyTOTPBodySchema = z.object({
 	code: z.string().meta({ description: "The otp code to verify. Eg: \"012345\"" }),
@@ -88,7 +99,7 @@ const totp2fa = (options) => {
 			}]
 		});
 		if (!twoFactor) throw APIError.from("BAD_REQUEST", TWO_FACTOR_ERROR_CODES.TOTP_NOT_ENABLED);
-		const secret = await symmetricDecrypt({
+		const secret = await decryptTOTPSecret({
 			key: ctx.context.secretConfig,
 			data: twoFactor.secret
 		});
@@ -139,7 +150,7 @@ const totp2fa = (options) => {
 		const attempt = isSignIn ? await beginAttempt(5) : null;
 		let status;
 		try {
-			const decrypted = await symmetricDecrypt({
+			const decrypted = await decryptTOTPSecret({
 				key: ctx.context.secretConfig,
 				data: twoFactor.secret
 			});

package/dist/plugins/username/index.mjs

@@ -155,24 +155,14 @@ const usernameImpl = (options, includeDisplayUsername) => {
 					ctx.context.logger.warn("Username or password not found");
 					throw APIError.from("UNAUTHORIZED", USERNAME_ERROR_CODES.INVALID_USERNAME_OR_PASSWORD);
 				}
-				const username = options?.validationOrder?.username === "pre-normalization" ? normalizer(ctx.body.username) : ctx.body.username;
-				const minUsernameLength = options?.minUsernameLength || 3;
-				const maxUsernameLength = options?.maxUsernameLength || 30;
-				if (username.length < minUsernameLength) {
-					ctx.context.logger.warn("Username too short");
-					throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.USERNAME_TOO_SHORT);
-				}
-				if (username.length > maxUsernameLength) {
-					ctx.context.logger.warn("Username too long");
-					throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
-				}
-				if (!await (options?.usernameValidator || defaultUsernameValidator)(username)) throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.INVALID_USERNAME);
+				const validationError = await validateUsernameValue(ctx.body.username);
+				if (validationError) throw APIError.from("UNPROCESSABLE_ENTITY", validationError);
 				assertPasswordNotTooLong(ctx, ctx.body.password);
 				const user = await ctx.context.adapter.findOne({
 					model: "user",
 					where: [{
 						field: "username",
-						value: normalizer(username)
+						value: normalizer(ctx.body.username)
 					}]
 				});
 				if (!user) {
@@ -227,11 +217,8 @@ const usernameImpl = (options, includeDisplayUsername) => {
 			}, async (ctx) => {
 				const username = ctx.body.username;
 				if (!username) throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.INVALID_USERNAME);
-				const minUsernameLength = options?.minUsernameLength || 3;
-				const maxUsernameLength = options?.maxUsernameLength || 30;
-				if (username.length < minUsernameLength) throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.USERNAME_TOO_SHORT);
-				if (username.length > maxUsernameLength) throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
-				if (!await (options?.usernameValidator || defaultUsernameValidator)(username)) throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.INVALID_USERNAME);
+				const validationError = await validateUsernameValue(username);
+				if (validationError) throw APIError.from("UNPROCESSABLE_ENTITY", validationError);
 				if (await ctx.context.adapter.findOne({
 					model: "user",
 					where: [{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.13",
+  "version": "1.7.15",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -503,13 +503,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.13",
-    "@better-auth/drizzle-adapter": "1.7.13",
-    "@better-auth/kysely-adapter": "1.7.13",
-    "@better-auth/memory-adapter": "1.7.13",
-    "@better-auth/mongo-adapter": "1.7.13",
-    "@better-auth/prisma-adapter": "1.7.13",
-    "@better-auth/telemetry": "1.7.13"
+    "@better-auth/core": "1.7.15",
+    "@better-auth/drizzle-adapter": "1.7.15",
+    "@better-auth/kysely-adapter": "1.7.15",
+    "@better-auth/memory-adapter": "1.7.15",
+    "@better-auth/mongo-adapter": "1.7.15",
+    "@better-auth/prisma-adapter": "1.7.15",
+    "@better-auth/telemetry": "1.7.15"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",