better-auth 1.7.16 → 1.7.17

package/dist/auth/trusted-origins.mjs

@@ -1,11 +1,12 @@
 import { wildcardMatch } from "../utils/wildcard.mjs";
 import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
+import * as z from "zod";
 //#region src/auth/trusted-origins.ts
 const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
 const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
 const IP_WILDCARD_HOST_PATTERN = /^(?=.*\d)[\d*?.]+$/;
-const IPV4_HOST_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+const ipv4Schema = z.ipv4();
 /**
 * A wildcard host made only of digits, dots and wildcards (`192.168.*.*`,
 * `10.*`) names an address range, so it admits only an IPv4 address. A plain
@@ -13,9 +14,10 @@ const IPV4_HOST_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 * hosts keep the documented subdomain matching.
 */
 const isAllowedIPv4Host = (patternAuthority, authority) => {
-	const patternHost = patternAuthority.split(":")[0];
+	const [patternHost = ""] = patternAuthority.split(":");
 	if (!IP_WILDCARD_HOST_PATTERN.test(patternHost)) return true;
-	return IPV4_HOST_PATTERN.test(authority.split(":")[0]);
+	const [host = ""] = authority.split(":");
+	return z.validate(ipv4Schema, host);
 };
 /**
 * Resolves `.` and `..` segments in a path after percent-decoding so a

package/dist/cookies/index.mjs

@@ -177,6 +177,7 @@ async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
 		...overrides
 	});
 	if (dontRememberMe) await ctx.setSignedCookie(ctx.context.authCookies.dontRememberToken.name, "true", ctx.context.secret, ctx.context.authCookies.dontRememberToken.attributes);
+	else if (dontRememberMeCookie) expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
 	await setCookieCache(ctx, session, dontRememberMe);
 	ctx.context.setNewSession(session);
 }

package/dist/db/internal-adapter.mjs

@@ -104,10 +104,9 @@ const createInternalAdapter = (adapter, ctx) => {
 		}
 		await secondaryStorage.delete(activeSessionsKey);
 	}
-	async function queueCachedUserSessionDeletion(userId, sessionReferences) {
+	async function queueCachedUserSessionDeletion(userId, sessionReferences, revokedAt = Date.now()) {
 		if (!secondaryStorage) return;
 		const references = sessionReferences ?? await getActiveSessionReferences(userId);
-		const revokedAt = Date.now();
 		await queueAfterTransactionHook(() => deleteCachedUserSessions(userId, references, revokedAt), { onError(error) {
 			logger.error("Failed to delete committed user sessions from secondary storage", error);
 		} });
@@ -532,24 +531,25 @@ const createInternalAdapter = (adapter, ctx) => {
 			}], "account", void 0);
 		},
 		deleteUserSessions: async (userId) => {
+			const revokedAt = Date.now();
 			const sessionReferences = await getActiveSessionReferences(userId);
 			if (secondaryStorage) {
 				if (!options.session?.storeSessionInDatabase) {
-					await queueCachedUserSessionDeletion(userId, sessionReferences);
+					await queueCachedUserSessionDeletion(userId, sessionReferences, revokedAt);
 					return;
 				}
 				if (ctx.options.session?.preserveSessionInDatabase) {
 					if (await endPreservedSessions([{
 						field: "userId",
 						value: userId
-					}]) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences);
+					}]) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences, revokedAt);
 					return;
 				}
 			}
 			if (await deleteManyWithHooks([{
 				field: "userId",
 				value: userId
-			}], "session", void 0) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences);
+			}], "session", void 0) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences, revokedAt);
 		},
 		deleteSessions: async (sessionTokens) => {
 			if (secondaryStorage) {

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.16";
+var version = "1.7.17";
 //#endregion
 export { version };

package/dist/plugins/device-authorization/routes.mjs

@@ -1,6 +1,6 @@
 import { ms } from "../../utils/time.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
-import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx } from "../../api/routes/session.mjs";
 import { DEVICE_AUTHORIZATION_ERROR_CODES } from "./error-codes.mjs";
 import { APIError } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -651,7 +651,7 @@ const deviceDeny = createAuthEndpoint("/device/deny", {
 		} }
 	} }
 }, async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) throw new APIError("UNAUTHORIZED", {
 		error: "unauthorized",
 		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED.message

package/dist/plugins/phone-number/index.mjs

@@ -22,7 +22,7 @@ const phoneNumber = (options) => {
 		init() {
 			return { options: { databaseHooks: { user: {
 				create: { async before(data, ctx) {
-					if (!data[opts.phoneNumber] || data[opts.phoneNumberVerified] === true) return;
+					if (data[opts.phoneNumber] == null || data[opts.phoneNumberVerified] === true) return;
 					if (ctx?.body?.[opts.phoneNumber]) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_CANNOT_BE_SET);
 					return { data: {
 						...data,
@@ -35,7 +35,7 @@ const phoneNumber = (options) => {
 						...data,
 						[opts.phoneNumberVerified]: false
 					} };
-					if (!ctx || !data[opts.phoneNumber] || data[opts.phoneNumberVerified] === true || ctx.path === "/admin/update-user") return;
+					if (!ctx || data[opts.phoneNumber] == null || data[opts.phoneNumberVerified] === true || ctx.path === "/admin/update-user") return;
 					return { data: {
 						...data,
 						[opts.phoneNumber]: void 0

package/dist/plugins/two-factor/backup-codes/index.d.mts

@@ -170,7 +170,7 @@ export declare const backupCode2fa: (opts: BackupCodeOptions) => {
       };
     }, {
       token: string | undefined;
-      user: (Record<string, any> & {
+      user: ({
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -178,7 +178,7 @@ export declare const backupCode2fa: (opts: BackupCodeOptions) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      }) | UserWithTwoFactor;
+      } & Record<string, any>) | UserWithTwoFactor;
     }>;
     /**
      * ### Endpoint

package/dist/plugins/two-factor/index.d.mts

@@ -295,7 +295,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       };
     }, {
       token: string | undefined;
-      user: (Record<string, any> & {
+      user: ({
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -303,7 +303,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      }) | UserWithTwoFactor;
+      } & Record<string, any>) | UserWithTwoFactor;
     }>;
     generateBackupCodes: import("better-call").StrictEndpoint<"/two-factor/generate-backup-codes", {
       method: "POST";
@@ -490,7 +490,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -498,7 +498,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
     generateTOTP: import("better-call").StrictEndpoint<string, {
       method: "POST";
@@ -621,7 +621,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -629,7 +629,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
   options: NoInfer<O>;

package/dist/plugins/two-factor/index.mjs

@@ -27,7 +27,7 @@ const signInPaths = /* @__PURE__ */ new Set([
 const signInTwoFactorStates = /* @__PURE__ */ new WeakMap();
 async function readSignInTwoFactorState(ctx, trustDeviceMaxAge) {
 	const data = ctx.context.newSession;
-	if (!signInPaths.has(ctx.path) || !data?.user.twoFactorEnabled) return {
+	if (!data?.user.twoFactorEnabled) return {
 		requiresTwoFactor: false,
 		trustDeviceCookie: null
 	};
@@ -90,6 +90,7 @@ const twoFactor = (options) => {
 		return state;
 	}
 	async function shouldRequireTwoFactor(ctx) {
+		if (!signInPaths.has(ctx.path)) return false;
 		return (await getSignInTwoFactorState(ctx)).requiresTwoFactor;
 	}
 	return {

package/dist/plugins/two-factor/otp/index.d.mts

@@ -198,7 +198,7 @@ export declare const otp2fa: (options?: OTPOptions | undefined) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -206,7 +206,7 @@ export declare const otp2fa: (options?: OTPOptions | undefined) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
 };

package/dist/plugins/two-factor/totp/index.d.mts

@@ -201,7 +201,7 @@ export declare const totp2fa: (options?: TOTPOptions | undefined) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -209,7 +209,7 @@ export declare const totp2fa: (options?: TOTPOptions | undefined) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
 };

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -2,6 +2,7 @@ import { parseUserOutput } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { expireCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getAuthoritativeSessionFromCtx } from "../../api/routes/session.mjs";
+import { isSessionOutsideStore } from "../../api/state/session-source.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
 import { TRUST_DEVICE_COOKIE_NAME, TWO_FACTOR_COOKIE_NAME } from "./constant.mjs";
 import { APIError } from "@better-auth/core/error";
@@ -11,7 +12,8 @@ async function verifyTwoFactor(ctx) {
 	const invalid = (errorKey) => {
 		throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES[errorKey]);
 	};
-	const session = await getAuthoritativeSessionFromCtx(ctx);
+	const requestSession = ctx.context.session;
+	const session = requestSession && await isSessionOutsideStore(requestSession.session.token) ? requestSession : await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) {
 		const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME);
 		const signedTwoFactorCookie = await ctx.getSignedCookie(twoFactorCookie.name, ctx.context.secret);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.16",
+  "version": "1.7.17",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -503,13 +503,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.16",
-    "@better-auth/drizzle-adapter": "1.7.16",
-    "@better-auth/kysely-adapter": "1.7.16",
-    "@better-auth/memory-adapter": "1.7.16",
-    "@better-auth/mongo-adapter": "1.7.16",
-    "@better-auth/prisma-adapter": "1.7.16",
-    "@better-auth/telemetry": "1.7.16"
+    "@better-auth/core": "1.7.17",
+    "@better-auth/drizzle-adapter": "1.7.17",
+    "@better-auth/kysely-adapter": "1.7.17",
+    "@better-auth/memory-adapter": "1.7.17",
+    "@better-auth/mongo-adapter": "1.7.17",
+    "@better-auth/prisma-adapter": "1.7.17",
+    "@better-auth/telemetry": "1.7.17"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -529,8 +529,8 @@
     "msw": "^2.14.6",
     "next": "^16.4.2",
     "oauth2-mock-server": "^9.0.0",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "solid-js": "^1.9.11",
     "tsdown": "0.23.1",
     "type-fest": "^5.7.0",