better-auth 1.7.15 → 1.7.17

package/dist/api/index.d.mts

@@ -21,6 +21,7 @@ import { updateSession } from "./routes/update-session.mjs";
 import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
 import "./routes/index.mjs";
 import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
+import { markSessionOutsideStore } from "./state/session-source.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { AuthContext, Awaitable, BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { InternalLogger } from "@better-auth/core/env";
@@ -4048,4 +4049,4 @@ export declare const router: <Option extends BetterAuthOptions>(ctx: AuthContext
   } extends (infer T_2) ? { [K in keyof T_2 as K extends keyof T_1 ? never : K]: T_2[K]; } : never) & T_1> : never : never : never;
 };
 //#endregion
-export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, type AuthEndpoint, type AuthMiddleware, type DispatchContext, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/index.mjs

@@ -2,9 +2,9 @@ import { isAPIError } from "../utils/is-api-error.mjs";
 import { requireOrgRole, requireResourceOwnership } from "./middlewares/authorization.mjs";
 import { formCsrfMiddleware, originCheck, originCheckMiddleware } from "./middlewares/origin-check.mjs";
 import { onRequestRateLimit } from "./rate-limiter/index.mjs";
-import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { getShouldSkipSessionRefresh, setShouldSkipSessionRefresh } from "./state/should-session-refresh.mjs";
 import { freshSessionMiddleware, getAuthoritativeSessionFromCtx, getSession, getSessionFromCtx, isStateful, listSessions, requestOnlySessionMiddleware, revokeOtherSessions, revokeSession, revokeSessions, sensitiveSessionMiddleware, sessionMiddleware } from "./routes/session.mjs";
+import { addOAuthServerContext, getOAuthState } from "./state/oauth.mjs";
 import { accountInfo, getAccessToken, linkSocialAccount, listUserAccounts, refreshToken, unlinkAccount } from "./routes/account.mjs";
 import { callbackOAuth } from "./routes/callback.mjs";
 import { createEmailVerificationToken, sendVerificationEmail, sendVerificationEmailFn, verifyEmail } from "./routes/email-verification.mjs";
@@ -18,6 +18,7 @@ import { updateSession } from "./routes/update-session.mjs";
 import { changeEmail, changePassword, deleteUser, deleteUserCallback, setPassword, updateUser } from "./routes/update-user.mjs";
 import { dispatchAuthEndpoint } from "./dispatch.mjs";
 import { toAuthEndpoints } from "./to-auth-endpoints.mjs";
+import { markSessionOutsideStore } from "./state/session-source.mjs";
 import { logger } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
 import { getIP } from "@better-auth/core/utils/ip";
@@ -222,4 +223,4 @@ const router = (ctx, options) => {
 	});
 };
 //#endregion
-export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };
+export { APIError, NO_STORE_HEADERS, accountInfo, addOAuthServerContext, callbackOAuth, changeEmail, changePassword, checkEndpointConflicts, createAuthEndpoint, createAuthMiddleware, createEmailVerificationToken, deleteUser, deleteUserCallback, dispatchAuthEndpoint, error, formCsrfMiddleware, freshSessionMiddleware, getAccessToken, getAuthoritativeSessionFromCtx, getEndpoints, getIP, getOAuthState, getSession, getSessionFromCtx, getShouldSkipSessionRefresh, isAPIError, isStateful, linkSocialAccount, listSessions, listUserAccounts, markSessionOutsideStore, ok, optionsMiddleware, originCheck, originCheckMiddleware, refreshToken, requestOnlySessionMiddleware, requestPasswordReset, requestPasswordResetCallback, requireOrgRole, requireResourceOwnership, resetPassword, revokeOtherSessions, revokeSession, revokeSessions, router, sendVerificationEmail, sendVerificationEmailFn, sensitiveSessionMiddleware, sessionMiddleware, setPassword, setShouldSkipSessionRefresh, signInEmail, signInSocial, signOut, signUpEmail, unlinkAccount, updateSession, updateUser, verifyEmail, verifyPassword };

package/dist/api/routes/account.mjs

@@ -1,13 +1,16 @@
 import { shouldBindAccountCookieToSessionUser } from "../../context/store-capabilities.mjs";
 import { parseAccountOutput } from "../../db/schema.mjs";
+import { symmetricEncrypt } from "../../crypto/index.mjs";
 import { getAccountCookie, setAccountCookie } from "../../cookies/session-store.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
 import { resolveOAuthAccountKeyForAPI } from "../../oauth2/account-key.mjs";
 import { missingEmailLogMessage } from "../../oauth2/errors.mjs";
+import { freshSessionMiddleware, getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
+import { toBoolean } from "../../utils/boolean.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
 import { applyUpdateUserInfoOnLink } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
-import { freshSessionMiddleware, getSessionFromCtx, isStateful, sessionMiddleware } from "./session.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -129,7 +132,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 		*/
 		additionalData: z.record(z.string(), z.any()).optional()
 	}),
-	use: [sessionMiddleware],
+	use: [sensitiveSessionMiddleware],
 	metadata: { openapi: {
 		description: "Link a social account to the user",
 		operationId: "linkSocialAccount",
@@ -169,11 +172,12 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			c.context.logger.warn("Invalid id token", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.INVALID_TOKEN);
 		}
-		const linkingUserInfo = await provider.getUserInfo({
+		const oauthTokens = {
 			idToken: token,
 			accessToken: c.body.idToken.accessToken,
 			refreshToken: c.body.idToken.refreshToken
-		});
+		};
+		const linkingUserInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!linkingUserInfo || !linkingUserInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -204,7 +208,7 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 			});
 		}
 		if (linkedAccount) throw APIError.from("CONFLICT", BASE_ERROR_CODES.SOCIAL_ACCOUNT_ALREADY_LINKED);
-		if (!c.context.trustedProviders.includes(provider.id) && !linkingUserInfo.user.emailVerified || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
+		if (!c.context.trustedProviders.includes(provider.id) && !toBoolean(linkingUserInfo.user.emailVerified) || c.context.options.account?.accountLinking?.enabled === false) throw APIError.from("UNAUTHORIZED", {
 			message: "Account not linked - linking not allowed",
 			code: "LINKING_NOT_ALLOWED"
 		});
@@ -237,7 +241,11 @@ const linkSocialAccount = createAuthEndpoint("/link-social", {
 	const state = await generateState(c, {
 		link: {
 			userId: session.user.id,
-			email: session.user.email
+			email: session.user.email,
+			encryptedSessionToken: await symmetricEncrypt({
+				key: derivePurposeKey(c.context.secretConfig, "oauth-link-session-token"),
+				data: session.session.token
+			})
 		},
 		additionalData: c.body.additionalData,
 		idTokenNonce

package/dist/api/routes/email-verification.mjs

@@ -26,7 +26,7 @@ async function sendVerificationEmailFn(ctx, user) {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.VERIFICATION_EMAIL_NOT_ENABLED);
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+	const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 	const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 	await ctx.context.options.emailVerification.sendVerificationEmail({
@@ -183,24 +183,30 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 	const parsed = z.object({
 		email: z.email(),
 		updateTo: z.string().optional(),
-		requestType: z.string().optional()
+		requestType: z.string().optional(),
+		userId: z.string().optional()
 	}).parse(jwt.payload);
-	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
-	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
 	if (parsed.updateTo) {
+		if (!parsed.userId) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
+		const boundUser = await ctx.context.internalAdapter.findUserById(parsed.userId);
+		if (!boundUser) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+		if (boundUser.email.toLowerCase() !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 		const session = await getSessionFromCtx(ctx);
-		if (session && session.user.email !== parsed.email) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
+		if (session && session.user.id !== boundUser.id) return redirectOnError(BASE_ERROR_CODES.INVALID_USER);
 		switch (parsed.requestType) {
 			/**
 			* User clicks confirmation -> sends verification to new email
 			*/
 			case "change-email-confirmation": {
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.email, parsed.updateTo, ctx.context.options.emailVerification?.expiresIn, {
+					requestType: "change-email-verification",
+					userId: boundUser.id
+				});
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				const url = `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`;
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: {
-						...user.user,
+						...boundUser,
 						email: parsed.updateTo
 					},
 					url,
@@ -213,26 +219,18 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* User clicks verification -> updates email
 			*/
 			case "change-email-verification": {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const emailVerified = boundUser.emailVerified;
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
-					emailVerified: true
+					emailVerified
 				});
-				if (ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (emailVerified && ctx.context.options.emailVerification?.afterEmailVerification) await ctx.context.options.emailVerification.afterEmailVerification(updatedUser, ctx.request);
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
-						emailVerified: true
+						emailVerified
 					}
 				});
 				if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
@@ -248,30 +246,21 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			* - updates email immediately
 			*/
 			default: {
-				let activeSession = session;
-				if (!activeSession) {
-					const newSession = await ctx.context.internalAdapter.createSession(user.user.id);
-					if (!newSession) throw APIError.from("INTERNAL_SERVER_ERROR", BASE_ERROR_CODES.FAILED_TO_CREATE_SESSION);
-					activeSession = {
-						session: newSession,
-						user: user.user
-					};
-				}
-				const updatedUser = await ctx.context.internalAdapter.updateUserByEmail(parsed.email, {
+				const updatedUser = await ctx.context.internalAdapter.updateUser(boundUser.id, {
 					email: parsed.updateTo,
 					emailVerified: false
 				});
-				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo);
+				const newToken = await createEmailVerificationToken(ctx.context.secret, parsed.updateTo, void 0, void 0, { userId: boundUser.id });
 				const updateCallbackURL = ctx.query.callbackURL ? encodeURIComponent(ctx.query.callbackURL) : encodeURIComponent("/");
 				if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 					user: updatedUser,
 					url: `${ctx.context.baseURL}/verify-email?token=${newToken}&callbackURL=${updateCallbackURL}`,
 					token: newToken
 				}, safeCloneRequest(ctx.request)));
-				await setSessionCookie(ctx, {
-					session: activeSession.session,
+				if (session) await setSessionCookie(ctx, {
+					session: session.session,
 					user: {
-						...activeSession.user,
+						...session.user,
 						email: parsed.updateTo,
 						emailVerified: false
 					}
@@ -284,6 +273,9 @@ const verifyEmail = createAuthEndpoint("/verify-email", {
 			}
 		}
 	}
+	const user = await ctx.context.internalAdapter.findUserByEmail(parsed.email);
+	if (!user) return redirectOnError(BASE_ERROR_CODES.USER_NOT_FOUND);
+	if (parsed.userId && parsed.userId !== user.user.id) return redirectOnError(BASE_ERROR_CODES.INVALID_TOKEN);
 	if (user.user.emailVerified) {
 		if (ctx.query.callbackURL) throw ctx.redirect(ctx.query.callbackURL);
 		return ctx.json({

package/dist/api/routes/sign-in.mjs

@@ -167,7 +167,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 			refreshToken: c.body.idToken.refreshToken,
 			user: c.body.idToken.user
 		};
-		const userInfo = await provider.getUserInfo(oauthTokens);
+		const userInfo = provider.getUserInfoFromIdToken ? await provider.getUserInfoFromIdToken(token) : await provider.getUserInfo(oauthTokens);
 		if (!userInfo || !userInfo?.user) {
 			c.context.logger.error("Failed to get user info", { provider: c.body.provider });
 			throw APIError.from("UNAUTHORIZED", BASE_ERROR_CODES.FAILED_TO_GET_USER_INFO);
@@ -338,7 +338,7 @@ const signInEmail = () => createAuthEndpoint("/sign-in/email", {
 	if (ctx.context.options?.emailAndPassword?.requireEmailVerification && !user.emailVerified) {
 		if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
 		if (ctx.context.options?.emailVerification?.sendOnSignIn) {
-			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 			const callbackURL = ctx.body.callbackURL ? encodeURIComponent(ctx.body.callbackURL) : encodeURIComponent("/");
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 			await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({

package/dist/api/routes/sign-up.mjs

@@ -239,7 +239,7 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 			password: hash
 		});
 		if (ctx.context.options.emailVerification?.sendOnSignUp ?? ctx.context.options.emailAndPassword.requireEmailVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, createdUser.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, createdUser.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: createdUser.id });
 			const callbackURL = body.callbackURL ? encodeURIComponent(body.callbackURL) : encodeURIComponent("/");
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${callbackURL}`;
 			if (ctx.context.options.emailVerification?.sendVerificationEmail) await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({

package/dist/api/routes/update-user.mjs

@@ -450,7 +450,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
 	if (await ctx.context.internalAdapter.findUserByEmail(newEmail)) {
-		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn);
+		await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 		ctx.context.logger.info("Change email attempt for existing email");
 		return ctx.json({ status: true });
 	}
@@ -467,7 +467,7 @@ const changeEmail = createAuthEndpoint("/change-email", {
 			}
 		});
 		if (canSendVerification) {
-			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn);
+			const token = await createEmailVerificationToken(ctx.context.secret, newEmail, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: ctx.context.session.user.id });
 			const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 			await ctx.context.runInBackgroundOrAwait(canSendVerification({
 				user: {
@@ -484,7 +484,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 	* If the email is verified, we need to send a verification email
 	*/
 	if (canSendConfirmation) {
-		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-confirmation" });
+		const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+			requestType: "change-email-confirmation",
+			userId: ctx.context.session.user.id
+		});
 		const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 		await ctx.context.runInBackgroundOrAwait(canSendConfirmation({
 			user: ctx.context.session.user,
@@ -498,7 +501,10 @@ const changeEmail = createAuthEndpoint("/change-email", {
 		ctx.context.logger.error("Verification email isn't enabled.");
 		throw APIError.fromStatus("BAD_REQUEST", { message: "Verification email isn't enabled" });
 	}
-	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, { requestType: "change-email-verification" });
+	const token = await createEmailVerificationToken(ctx.context.secret, ctx.context.session.user.email, newEmail, ctx.context.options.emailVerification?.expiresIn, {
+		requestType: "change-email-verification",
+		userId: ctx.context.session.user.id
+	});
 	const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 	await ctx.context.runInBackgroundOrAwait(canSendVerification({
 		user: {

package/dist/api/state/session-source.d.mts

@@ -0,0 +1,10 @@
+//#region src/api/state/session-source.d.ts
+/**
+ * Marks the request session with `token` as built without a session-store
+ * row. Checks that re-read the store to catch a concurrent revocation skip
+ * such sessions.
+ *
+ * @internal Shared by Better Auth packages; not a supported public API.
+ */
+export declare function markSessionOutsideStore(token: string): Promise<void>;
+//#endregion

package/dist/api/state/session-source.mjs

@@ -0,0 +1,28 @@
+import { defineRequestState } from "@better-auth/core/context";
+//#region src/api/state/session-source.ts
+/**
+* Tokens of request sessions that a plugin built without a session-store
+* row, such as one authenticated by an API key on every request.
+*/
+const { get: getTokensOutsideStore } = defineRequestState(() => /* @__PURE__ */ new Set());
+/**
+* Marks the request session with `token` as built without a session-store
+* row. Checks that re-read the store to catch a concurrent revocation skip
+* such sessions.
+*
+* @internal Shared by Better Auth packages; not a supported public API.
+*/
+async function markSessionOutsideStore(token) {
+	(await getTokensOutsideStore()).add(token);
+}
+/**
+* Whether the request session with `token` was marked by
+* `markSessionOutsideStore`. Outside a request, nothing is marked.
+*
+* @internal Shared by Better Auth packages; not a supported public API.
+*/
+async function isSessionOutsideStore(token) {
+	return (await getTokensOutsideStore().catch(() => null))?.has(token) ?? false;
+}
+//#endregion
+export { isSessionOutsideStore, markSessionOutsideStore };

package/dist/auth/trusted-origins.mjs

@@ -1,9 +1,24 @@
 import { wildcardMatch } from "../utils/wildcard.mjs";
 import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
+import * as z from "zod";
 //#region src/auth/trusted-origins.ts
 const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
 const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
+const IP_WILDCARD_HOST_PATTERN = /^(?=.*\d)[\d*?.]+$/;
+const ipv4Schema = z.ipv4();
+/**
+* A wildcard host made only of digits, dots and wildcards (`192.168.*.*`,
+* `10.*`) names an address range, so it admits only an IPv4 address. A plain
+* `*` would otherwise cross `.` and let `192.168.attacker.com` match. Other
+* hosts keep the documented subdomain matching.
+*/
+const isAllowedIPv4Host = (patternAuthority, authority) => {
+	const [patternHost = ""] = patternAuthority.split(":");
+	if (!IP_WILDCARD_HOST_PATTERN.test(patternHost)) return true;
+	const [host = ""] = authority.split(":");
+	return z.validate(ipv4Schema, host);
+};
 /**
 * Resolves `.` and `..` segments in a path after percent-decoding so a
 * path-pinned pattern cannot be bypassed with traversal: e.g.
@@ -33,7 +48,7 @@ const normalizePath = (path) => {
 * host); the path is percent-decoded and resolved so traversal cannot bypass
 * a path-pinned pattern.
 */
-const parseCustomSchemeOrigin = (value) => {
+const parseCustomSchemeOrigin = (value, wildcardPattern = false) => {
 	if (CONTROL_CHARACTER_PATTERN.test(value)) return null;
 	const schemeEnd = value.indexOf(":");
 	if (schemeEnd <= 0) return null;
@@ -42,7 +57,7 @@ const parseCustomSchemeOrigin = (value) => {
 	let authority = "";
 	if (rest.startsWith("//")) {
 		rest = rest.slice(2);
-		const authorityEnd = rest.search(/[/?#]/);
+		const authorityEnd = rest.search(wildcardPattern ? /[/#]/ : /[/?#]/);
 		if (authorityEnd === -1) {
 			authority = rest;
 			rest = "";
@@ -51,7 +66,7 @@ const parseCustomSchemeOrigin = (value) => {
 			rest = rest.slice(authorityEnd);
 		}
 	}
-	const pathEnd = rest.search(/[?#]/);
+	const pathEnd = rest.search(wildcardPattern ? /#/ : /[?#]/);
 	const path = normalizePath(pathEnd === -1 ? rest : rest.slice(0, pathEnd));
 	return {
 		scheme,
@@ -87,17 +102,27 @@ const isSafeRelativeURL = (value) => {
 */
 const matchesOriginPattern = (url, pattern, settings) => {
 	if (url.startsWith("/")) return settings?.allowRelativePaths === true && isSafeRelativeURL(url);
-	if (pattern.includes("*") || pattern.includes("?")) {
-		if (pattern.includes("://")) return wildcardMatch(pattern)(getOrigin(url) || url);
+	const hasWildcard = pattern.includes("*") || pattern.includes("?");
+	if (hasWildcard && !pattern.includes("://")) {
 		const host = getHost(url);
 		if (!host) return false;
-		return wildcardMatch(pattern)(host);
+		return wildcardMatch(pattern)(host) && isAllowedIPv4Host(pattern, host);
 	}
 	const protocol = getProtocol(url);
-	if (protocol === "http:" || protocol === "https:" || !protocol) return pattern === getOrigin(url);
+	if (protocol === "http:" || protocol === "https:" || !protocol) {
+		if (!hasWildcard) return pattern === getOrigin(url);
+		const origin = getOrigin(url);
+		if (origin === null || !wildcardMatch(pattern)(origin)) return false;
+		return isAllowedIPv4Host(pattern.slice(pattern.indexOf("://") + 3), origin.slice(origin.indexOf("://") + 3));
+	}
 	const parsed = parseCustomSchemeOrigin(url);
-	const parsedPattern = parseCustomSchemeOrigin(pattern);
+	const parsedPattern = parseCustomSchemeOrigin(pattern, hasWildcard);
 	if (!parsed || !parsedPattern || parsed.scheme !== parsedPattern.scheme) return false;
+	if (hasWildcard) {
+		if (parsed.authority.includes("@")) return false;
+		if (parsedPattern.authority && !(wildcardMatch(parsedPattern.authority)(parsed.authority) && isAllowedIPv4Host(parsedPattern.authority, parsed.authority))) return false;
+		return !parsedPattern.path || wildcardMatch(parsedPattern.path)(parsed.path || "/");
+	}
 	if (parsedPattern.authority && parsed.authority !== parsedPattern.authority) return false;
 	if (!parsedPattern.path) return true;
 	return parsed.path === parsedPattern.path || parsed.path.startsWith(`${parsedPattern.path}/`);

package/dist/client/index.d.mts

@@ -16,7 +16,8 @@ import { OrganizationOptions } from "../plugins/organization/types.mjs";
 import { InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationInput, OrganizationRole, OrganizationSchema, Team, TeamInput, TeamMember, TeamMemberInput, defaultRolesSchema, invitationSchema, invitationStatus, memberSchema, organizationRoleSchema, organizationSchema, roleSchema, teamMemberSchema, teamSchema } from "../plugins/organization/schema.mjs";
 import { getOrgAdapter } from "../plugins/organization/adapter.mjs";
 import { hasPermission } from "../plugins/organization/has-permission.mjs";
-import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "../plugins/organization/organization.mjs";
+import { parseRoles } from "../plugins/organization/roles.mjs";
+import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization } from "../plugins/organization/organization.mjs";
 import "../plugins/organization/index.mjs";
 import { BetterAuthOptions, BetterAuthPlugin } from "@better-auth/core";
 import { DBPrimitive } from "@better-auth/core/db";

package/dist/cookies/index.mjs

@@ -177,6 +177,7 @@ async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
 		...overrides
 	});
 	if (dontRememberMe) await ctx.setSignedCookie(ctx.context.authCookies.dontRememberToken.name, "true", ctx.context.secret, ctx.context.authCookies.dontRememberToken.attributes);
+	else if (dontRememberMeCookie) expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
 	await setCookieCache(ctx, session, dontRememberMe);
 	ctx.context.setNewSession(session);
 }

package/dist/db/internal-adapter.mjs

@@ -78,8 +78,18 @@ const createInternalAdapter = (adapter, ctx) => {
 		const activeSessions = await secondaryStorage.get(`active-sessions-${userId}`);
 		return activeSessions ? safeJSONParse(activeSessions) || [] : [];
 	}
-	async function deleteCachedUserSessions(userId, sessionReferences) {
+	const revokedBeforeKey = (userId) => `revoked-sessions-before-${userId}`;
+	const revokedBeforeTTL = Math.max(sessionExpiration, 86400, Number(options.plugins?.find((plugin) => plugin.id === "admin")?.options?.impersonationSessionDuration) || 0);
+	async function isRevokedSession(session, revokedBeforeByUser) {
+		if (!secondaryStorage) return false;
+		const revokedBefore = revokedBeforeByUser?.get(session.userId) ?? Number(await secondaryStorage.get(revokedBeforeKey(session.userId)));
+		revokedBeforeByUser?.set(session.userId, revokedBefore);
+		return new Date(session.createdAt).getTime() < revokedBefore;
+	}
+	async function deleteCachedUserSessions(userId, sessionReferences, revokedAt) {
 		if (!secondaryStorage) return;
+		const previousRevokedBefore = Number(await secondaryStorage.get(revokedBeforeKey(userId)));
+		await secondaryStorage.set(revokedBeforeKey(userId), String(Math.max(revokedAt, previousRevokedBefore || 0)), revokedBeforeTTL);
 		const deletedTokens = new Set(sessionReferences.map((session) => session.token));
 		for (const { token } of sessionReferences) await secondaryStorage.delete(token);
 		const activeSessionsKey = `active-sessions-${userId}`;
@@ -94,10 +104,10 @@ const createInternalAdapter = (adapter, ctx) => {
 		}
 		await secondaryStorage.delete(activeSessionsKey);
 	}
-	async function queueCachedUserSessionDeletion(userId, sessionReferences) {
+	async function queueCachedUserSessionDeletion(userId, sessionReferences, revokedAt = Date.now()) {
 		if (!secondaryStorage) return;
 		const references = sessionReferences ?? await getActiveSessionReferences(userId);
-		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references), { onError(error) {
+		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references, revokedAt), { onError(error) {
 			logger.error("Failed to delete committed user sessions from secondary storage", error);
 		} });
 	}
@@ -194,6 +204,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				const now = Date.now();
 				const seenTokens = /* @__PURE__ */ new Set();
 				const sessions = [];
+				const revokedBeforeByUser = /* @__PURE__ */ new Map();
 				for (const { token, expiresAt } of list) {
 					if (expiresAt <= now || seenTokens.has(token)) continue;
 					seenTokens.add(token);
@@ -201,7 +212,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					if (!data) continue;
 					try {
 						const parsed = typeof data === "string" ? JSON.parse(data) : data;
-						if (!parsed?.session) continue;
+						if (!parsed?.session || await isRevokedSession(parsed.session, revokedBeforeByUser)) continue;
 						sessions.push(parseSessionOutput(ctx.options, {
 							...parsed.session,
 							expiresAt: new Date(parsed.session.expiresAt)
@@ -312,7 +323,10 @@ const createInternalAdapter = (adapter, ctx) => {
 				});
 				const sessionTTL = getTTLSeconds(data.expiresAt, now);
 				if (sessionTTL > 0) await secondaryStorage.set(data.token, JSON.stringify({
-					session: sessionData,
+					session: {
+						...sessionData,
+						createdAt: data.createdAt
+					},
 					user
 				}), sessionTTL);
 				return sessionData;
@@ -336,7 +350,7 @@ const createInternalAdapter = (adapter, ctx) => {
 				if (!sessionStringified && (!options.session?.storeSessionInDatabase || ctx.options.session?.preserveSessionInDatabase)) return null;
 				if (sessionStringified) {
 					const s = safeJSONParse(sessionStringified);
-					if (!s) return null;
+					if (!s || await isRevokedSession(s.session)) return null;
 					return {
 						session: parseSessionOutput(ctx.options, {
 							...s.session,
@@ -372,11 +386,12 @@ const createInternalAdapter = (adapter, ctx) => {
 			const uniqueTokens = [...new Set(sessionTokens)];
 			const sessionsByToken = /* @__PURE__ */ new Map();
 			const missingTokens = [];
+			const revokedBeforeByUser = /* @__PURE__ */ new Map();
 			if (secondaryStorage) for (const sessionToken of uniqueTokens) {
 				const sessionStringified = await secondaryStorage.get(sessionToken);
 				if (sessionStringified) try {
 					const s = typeof sessionStringified === "string" ? JSON.parse(sessionStringified) : sessionStringified;
-					if (!s) continue;
+					if (!s || await isRevokedSession(s.session, revokedBeforeByUser)) continue;
 					const expiresAt = new Date(s.session.expiresAt);
 					if (options?.onlyActiveSessions && expiresAt <= /* @__PURE__ */ new Date()) continue;
 					const session = {
@@ -516,24 +531,25 @@ const createInternalAdapter = (adapter, ctx) => {
 			}], "account", void 0);
 		},
 		deleteUserSessions: async (userId) => {
+			const revokedAt = Date.now();
 			const sessionReferences = await getActiveSessionReferences(userId);
 			if (secondaryStorage) {
 				if (!options.session?.storeSessionInDatabase) {
-					await queueCachedUserSessionDeletion(userId, sessionReferences);
+					await queueCachedUserSessionDeletion(userId, sessionReferences, revokedAt);
 					return;
 				}
 				if (ctx.options.session?.preserveSessionInDatabase) {
 					if (await endPreservedSessions([{
 						field: "userId",
 						value: userId
-					}]) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences);
+					}]) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences, revokedAt);
 					return;
 				}
 			}
 			if (await deleteManyWithHooks([{
 				field: "userId",
 				value: userId
-			}], "session", void 0) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences);
+			}], "session", void 0) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences, revokedAt);
 		},
 		deleteSessions: async (sessionTokens) => {
 			if (secondaryStorage) {
@@ -590,6 +606,8 @@ const createInternalAdapter = (adapter, ctx) => {
 				join: { ...options?.includeAccounts ? { account: true } : {} }
 			});
 			if (!result) return null;
+			const normalize = (value) => value.normalize("NFC").toLowerCase();
+			if (normalize(result.email) !== normalize(email)) return null;
 			const { account: accounts, ...user } = result;
 			return {
 				user,

package/dist/index.d.mts

@@ -7,8 +7,8 @@ import { InferOptionSchema, InferPluginContext, InferPluginErrorCodes, InferPlug
 import { Auth } from "./types/auth.mjs";
 import { BetterAuthAdvancedOptions, BetterAuthCookies, BetterAuthOptions, BetterAuthPlugin, BetterAuthRateLimitOptions, StoreIdentifierOption, UserProvisioningSource, ValidateUserInfoAction, ValidateUserInfoMethod, ValidateUserInfoOAuthInfo, ValidateUserInfoResult, ValidateUserInfoSSOInfo, ValidateUserInfoSource } from "./types/index.mjs";
 import { betterAuth } from "./auth/full.mjs";
+import { StateData, generateGenericState, getAuthStateVerificationIdentifier, parseGenericState } from "./state.mjs";
 import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
-import { StateData, generateGenericState, parseGenericState } from "./state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
 import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./utils/url.mjs";
 import "./utils/index.mjs";
@@ -28,4 +28,4 @@ export * from "@better-auth/core/utils/json";
 export * from "@better-auth/core/social-providers";
 export type * from "better-call";
 export type * from "zod";
-export { APIError, type Account, type AdditionalSessionFieldsInput, type AdditionalUserFieldsInput, type Auth, type BetterAuthAdvancedOptions, type BetterAuthClientOptions, type BetterAuthClientPlugin, type BetterAuthCookies, type BetterAuthOptions, type BetterAuthPlugin, type BetterAuthRateLimitOptions, type ClientAtomListener, type ClientStore, type DBAdapter, type DBAdapterInstance, type DBAdapterSchemaCreation, type DBTransactionAdapter, type ExtractPluginField, FilteredAPI, GenerateStateOptions, HIDE_METADATA, type HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, type InferOptionSchema, type InferPluginContext, type InferPluginErrorCodes, type InferPluginFieldFromTuple, type InferPluginIDs, type InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, type IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, type JoinConfig, type JoinOption, type OverrideMerge, type Prettify, type PrettifyDeep, type RateLimit, type RequiredKeysOf, type Session, SessionQueryParams, type StandardSchemaV1, type StateData, type StoreIdentifierOption, type StripEmptyObjects, type TelemetryEvent, type UnionToIntersection, type User, type UserProvisioningSource, type ValidateUserInfoAction, type ValidateUserInfoMethod, type ValidateUserInfoOAuthInfo, type ValidateUserInfoResult, type ValidateUserInfoSSOInfo, type ValidateUserInfoSource, type Verification, type Where, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };
+export { APIError, type Account, type AdditionalSessionFieldsInput, type AdditionalUserFieldsInput, type Auth, type BetterAuthAdvancedOptions, type BetterAuthClientOptions, type BetterAuthClientPlugin, type BetterAuthCookies, type BetterAuthOptions, type BetterAuthPlugin, type BetterAuthRateLimitOptions, type ClientAtomListener, type ClientStore, type DBAdapter, type DBAdapterInstance, type DBAdapterSchemaCreation, type DBTransactionAdapter, type ExtractPluginField, FilteredAPI, GenerateStateOptions, HIDE_METADATA, type HasRequiredKeys, InferAPI, InferActions, InferAdditionalFromClient, InferClientAPI, InferErrorCodes, type InferOptionSchema, type InferPluginContext, type InferPluginErrorCodes, type InferPluginFieldFromTuple, type InferPluginIDs, type InferPluginTypes, InferSessionAPI, InferSessionFromClient, InferUserFromClient, type IsAny, IsSignal, type JSONWebKeySet, type JWTPayload, type JoinConfig, type JoinOption, type OverrideMerge, type Prettify, type PrettifyDeep, type RateLimit, type RequiredKeysOf, type Session, SessionQueryParams, type StandardSchemaV1, type StateData, type StoreIdentifierOption, type StripEmptyObjects, type TelemetryEvent, type UnionToIntersection, type User, type UserProvisioningSource, type ValidateUserInfoAction, type ValidateUserInfoMethod, type ValidateUserInfoOAuthInfo, type ValidateUserInfoResult, type ValidateUserInfoSSOInfo, type ValidateUserInfoSource, type Verification, type Where, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getAuthStateVerificationIdentifier, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./utils/url.mjs";
-import { generateGenericState, parseGenericState } from "./state.mjs";
+import { generateGenericState, getAuthStateVerificationIdentifier, parseGenericState } from "./state.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
 import { APIError } from "./api/index.mjs";
@@ -14,4 +14,4 @@ export * from "@better-auth/core/oauth2";
 export * from "@better-auth/core/utils/error-codes";
 export * from "@better-auth/core/utils/id";
 export * from "@better-auth/core/utils/json";
-export { APIError, HIDE_METADATA, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };
+export { APIError, HIDE_METADATA, betterAuth, createTelemetry, generateGenericState, generateIdTokenNonce, generateState, getAuthStateVerificationIdentifier, getBaseURL, getCurrentAdapter, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, getTelemetryAuthConfig, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };