better-auth 1.7.15 → 1.7.17

package/dist/plugins/two-factor/otp/index.d.mts

@@ -198,7 +198,7 @@ export declare const otp2fa: (options?: OTPOptions | undefined) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -206,7 +206,7 @@ export declare const otp2fa: (options?: OTPOptions | undefined) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
 };

package/dist/plugins/two-factor/totp/index.d.mts

@@ -201,7 +201,7 @@ export declare const totp2fa: (options?: TOTPOptions | undefined) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -209,7 +209,7 @@ export declare const totp2fa: (options?: TOTPOptions | undefined) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
 };

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -1,7 +1,8 @@
 import { parseUserOutput } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { expireCookie, setSessionCookie } from "../../cookies/index.mjs";
-import { getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx } from "../../api/routes/session.mjs";
+import { isSessionOutsideStore } from "../../api/state/session-source.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
 import { TRUST_DEVICE_COOKIE_NAME, TWO_FACTOR_COOKIE_NAME } from "./constant.mjs";
 import { APIError } from "@better-auth/core/error";
@@ -11,7 +12,8 @@ async function verifyTwoFactor(ctx) {
 	const invalid = (errorKey) => {
 		throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES[errorKey]);
 	};
-	const session = await getSessionFromCtx(ctx);
+	const requestSession = ctx.context.session;
+	const session = requestSession && await isSessionOutsideStore(requestSession.session.token) ? requestSession : await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) {
 		const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME);
 		const signedTwoFactorCookie = await ctx.getSignedCookie(twoFactorCookie.name, ctx.context.secret);

package/dist/plugins/username/index.mjs

@@ -187,7 +187,7 @@ const usernameImpl = (options, includeDisplayUsername) => {
 				if (ctx.context.options?.emailAndPassword?.requireEmailVerification && !user.emailVerified) {
 					if (!ctx.context.options?.emailVerification?.sendVerificationEmail) throw APIError.from("FORBIDDEN", USERNAME_ERROR_CODES.EMAIL_NOT_VERIFIED);
 					if (ctx.context.options?.emailVerification?.sendOnSignIn) {
-						const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn);
+						const token = await createEmailVerificationToken(ctx.context.secret, user.email, void 0, ctx.context.options.emailVerification?.expiresIn, { userId: user.id });
 						const url = `${ctx.context.baseURL}/verify-email?token=${token}&callbackURL=${encodeURIComponent(ctx.body.callbackURL || "/")}`;
 						await ctx.context.runInBackgroundOrAwait(ctx.context.options.emailVerification.sendVerificationEmail({
 							user,

package/dist/state.d.mts

@@ -12,12 +12,17 @@ declare const stateDataSchema: z.ZodObject<{
   link: z.ZodOptional<z.ZodObject<{
     email: z.ZodString;
     userId: z.ZodCoercedString<unknown>;
+    encryptedSessionToken: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>>;
   requestSignUp: z.ZodOptional<z.ZodBoolean>;
   idTokenNonce: z.ZodOptional<z.ZodString>;
   serverContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$loose>;
 export type StateData = z.infer<typeof stateDataSchema>;
+/**
+ * Verification key for database-backed OAuth and SAML relay state.
+ */
+export declare const getAuthStateVerificationIdentifier: (state: string) => string;
 export declare function generateGenericState(c: GenericEndpointContext, stateData: StateData, settings?: {
   cookieName: string;
 }): Promise<{
@@ -38,6 +43,7 @@ export declare function parseGenericState(c: GenericEndpointContext, state: stri
   link?: {
     email: string;
     userId: string;
+    encryptedSessionToken?: string | undefined;
   } | undefined;
   requestSignUp?: boolean | undefined;
   idTokenNonce?: string | undefined;

package/dist/state.mjs

@@ -18,7 +18,8 @@ const stateDataSchema = z.looseObject({
 	oauthState: z.string().optional(),
 	link: z.object({
 		email: z.string(),
-		userId: z.coerce.string()
+		userId: z.coerce.string(),
+		encryptedSessionToken: z.string().optional()
 	}).optional(),
 	requestSignUp: z.boolean().optional(),
 	/**
@@ -33,7 +34,9 @@ const stateDataSchema = z.looseObject({
 	*/
 	serverContext: z.record(z.string(), z.unknown()).optional()
 });
-/** Verification key for database-backed OAuth and SAML relay state. */
+/**
+* Verification key for database-backed OAuth and SAML relay state.
+*/
 const getAuthStateVerificationIdentifier = (state) => `auth-state:${state}`;
 const INTERNAL_STATE_KEYS = new Set(Object.keys(stateDataSchema.shape));
 var StateError = class extends BetterAuthError {

package/dist/utils/index.d.mts

@@ -1,5 +1,5 @@
+import { StateData, generateGenericState, getAuthStateVerificationIdentifier, parseGenericState } from "../state.mjs";
 import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "../oauth2/state.mjs";
-import { StateData, generateGenericState, parseGenericState } from "../state.mjs";
 import { HIDE_METADATA } from "./hide-metadata.mjs";
 import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes } from "./url.mjs";
-export { GenerateStateOptions, HIDE_METADATA, type StateData, generateGenericState, generateIdTokenNonce, generateState, getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };
+export { GenerateStateOptions, HIDE_METADATA, type StateData, generateGenericState, generateIdTokenNonce, generateState, getAuthStateVerificationIdentifier, getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProtocolFromSource, isDynamicBaseURLConfig, isRequestLike, matchesHostPattern, parseGenericState, parseState, resolveBaseURL, resolveDynamicBaseURL, trimTrailingSlashes };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.15",
+  "version": "1.7.17",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -497,19 +497,19 @@
     "@better-fetch/fetch": "1.3.3",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "better-call": "1.4.4",
+    "better-call": "1.4.5",
     "defu": "^6.1.4",
     "jose": "^6.2.3",
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.15",
-    "@better-auth/drizzle-adapter": "1.7.15",
-    "@better-auth/kysely-adapter": "1.7.15",
-    "@better-auth/memory-adapter": "1.7.15",
-    "@better-auth/mongo-adapter": "1.7.15",
-    "@better-auth/prisma-adapter": "1.7.15",
-    "@better-auth/telemetry": "1.7.15"
+    "@better-auth/core": "1.7.17",
+    "@better-auth/drizzle-adapter": "1.7.17",
+    "@better-auth/kysely-adapter": "1.7.17",
+    "@better-auth/memory-adapter": "1.7.17",
+    "@better-auth/mongo-adapter": "1.7.17",
+    "@better-auth/prisma-adapter": "1.7.17",
+    "@better-auth/telemetry": "1.7.17"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -529,8 +529,8 @@
     "msw": "^2.14.6",
     "next": "^16.4.2",
     "oauth2-mock-server": "^9.0.0",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "solid-js": "^1.9.11",
     "tsdown": "0.23.1",
     "type-fest": "^5.7.0",