better-auth 1.7.16 → 1.7.18

package/dist/auth/trusted-origins.mjs

@@ -1,11 +1,12 @@
 import { wildcardMatch } from "../utils/wildcard.mjs";
 import { getHost, getOrigin, getProtocol } from "../utils/url.mjs";
+import * as z from "zod";
 //#region src/auth/trusted-origins.ts
 const CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f-\u009f]/;
 const RELATIVE_URL_PARSER_ORIGIN = "https://better-auth.invalid";
 const ENCODED_PATH_SEPARATOR_PATTERN = /%2[fF]|%5[cC]/;
 const IP_WILDCARD_HOST_PATTERN = /^(?=.*\d)[\d*?.]+$/;
-const IPV4_HOST_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+const ipv4Schema = z.ipv4();
 /**
 * A wildcard host made only of digits, dots and wildcards (`192.168.*.*`,
 * `10.*`) names an address range, so it admits only an IPv4 address. A plain
@@ -13,9 +14,10 @@ const IPV4_HOST_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}$/;
 * hosts keep the documented subdomain matching.
 */
 const isAllowedIPv4Host = (patternAuthority, authority) => {
-	const patternHost = patternAuthority.split(":")[0];
+	const [patternHost = ""] = patternAuthority.split(":");
 	if (!IP_WILDCARD_HOST_PATTERN.test(patternHost)) return true;
-	return IPV4_HOST_PATTERN.test(authority.split(":")[0]);
+	const [host = ""] = authority.split(":");
+	return z.validate(ipv4Schema, host);
 };
 /**
 * Resolves `.` and `..` segments in a path after percent-decoding so a

package/dist/cookies/index.mjs

@@ -177,6 +177,7 @@ async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
 		...overrides
 	});
 	if (dontRememberMe) await ctx.setSignedCookie(ctx.context.authCookies.dontRememberToken.name, "true", ctx.context.secret, ctx.context.authCookies.dontRememberToken.attributes);
+	else if (dontRememberMeCookie) expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
 	await setCookieCache(ctx, session, dontRememberMe);
 	ctx.context.setNewSession(session);
 }

package/dist/db/internal-adapter.mjs

@@ -38,7 +38,7 @@ const createInternalAdapter = (adapter, ctx) => {
 	* or `deleteUserSessions` sweeping a user's accumulated preserved rows) would
 	* re-match it and re-fire the hooks, re-dispatching back-channel logout.
 	*/
-	const endPreservedSessions = (where) => {
+	const endPreservedSessions = (where, afterEnd) => {
 		const liveSessions = [...where, {
 			field: "expiresAt",
 			value: /* @__PURE__ */ new Date(),
@@ -51,6 +51,7 @@ const createInternalAdapter = (adapter, ctx) => {
 					where: liveSessions,
 					update: { expiresAt: /* @__PURE__ */ new Date() }
 				});
+				await afterEnd?.();
 			},
 			executeMainFn: false
 		});
@@ -91,7 +92,7 @@ const createInternalAdapter = (adapter, ctx) => {
 		const previousRevokedBefore = Number(await secondaryStorage.get(revokedBeforeKey(userId)));
 		await secondaryStorage.set(revokedBeforeKey(userId), String(Math.max(revokedAt, previousRevokedBefore || 0)), revokedBeforeTTL);
 		const deletedTokens = new Set(sessionReferences.map((session) => session.token));
-		for (const { token } of sessionReferences) await secondaryStorage.delete(token);
+		for (const token of deletedTokens) await secondaryStorage.delete(token);
 		const activeSessionsKey = `active-sessions-${userId}`;
 		const currentSessionReferences = await getActiveSessionReferences(userId);
 		const now = Date.now();
@@ -533,23 +534,39 @@ const createInternalAdapter = (adapter, ctx) => {
 		},
 		deleteUserSessions: async (userId) => {
 			const sessionReferences = await getActiveSessionReferences(userId);
-			if (secondaryStorage) {
-				if (!options.session?.storeSessionInDatabase) {
-					await queueCachedUserSessionDeletion(userId, sessionReferences);
-					return;
-				}
-				if (ctx.options.session?.preserveSessionInDatabase) {
-					if (await endPreservedSessions([{
-						field: "userId",
-						value: userId
-					}]) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences);
-					return;
-				}
+			if (!secondaryStorage) {
+				await deleteManyWithHooks([{
+					field: "userId",
+					value: userId
+				}], "session", void 0);
+				return;
+			}
+			if (!options.session?.storeSessionInDatabase) {
+				await queueCachedUserSessionDeletion(userId, sessionReferences);
+				return;
+			}
+			const revokeCachedSessions = async () => queueCachedUserSessionDeletion(userId, [...sessionReferences, ...await getActiveSessionReferences(userId)]);
+			if (ctx.options.session?.preserveSessionInDatabase) {
+				await endPreservedSessions([{
+					field: "userId",
+					value: userId
+				}], revokeCachedSessions);
+				return;
 			}
-			if (await deleteManyWithHooks([{
+			await deleteManyWithHooks([{
 				field: "userId",
 				value: userId
-			}], "session", void 0) !== null) await queueCachedUserSessionDeletion(userId, sessionReferences);
+			}], "session", {
+				fn: async (where) => {
+					const deleted = await (await getCurrentAdapter(adapter)).deleteMany({
+						model: "session",
+						where
+					});
+					await revokeCachedSessions();
+					return deleted;
+				},
+				executeMainFn: false
+			});
 		},
 		deleteSessions: async (sessionTokens) => {
 			if (secondaryStorage) {

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.16";
+var version = "1.7.18";
 //#endregion
 export { version };

package/dist/plugins/device-authorization/routes.mjs

@@ -1,6 +1,6 @@
 import { ms } from "../../utils/time.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
-import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
+import { getAuthoritativeSessionFromCtx } from "../../api/routes/session.mjs";
 import { DEVICE_AUTHORIZATION_ERROR_CODES } from "./error-codes.mjs";
 import { APIError } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -651,7 +651,7 @@ const deviceDeny = createAuthEndpoint("/device/deny", {
 		} }
 	} }
 }, async (ctx) => {
-	const session = await getSessionFromCtx(ctx);
+	const session = await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) throw new APIError("UNAUTHORIZED", {
 		error: "unauthorized",
 		error_description: DEVICE_AUTHORIZATION_ERROR_CODES.AUTHENTICATION_REQUIRED.message

package/dist/plugins/phone-number/index.mjs

@@ -22,7 +22,7 @@ const phoneNumber = (options) => {
 		init() {
 			return { options: { databaseHooks: { user: {
 				create: { async before(data, ctx) {
-					if (!data[opts.phoneNumber] || data[opts.phoneNumberVerified] === true) return;
+					if (data[opts.phoneNumber] == null || data[opts.phoneNumberVerified] === true) return;
 					if (ctx?.body?.[opts.phoneNumber]) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.PHONE_NUMBER_CANNOT_BE_SET);
 					return { data: {
 						...data,
@@ -35,7 +35,7 @@ const phoneNumber = (options) => {
 						...data,
 						[opts.phoneNumberVerified]: false
 					} };
-					if (!ctx || !data[opts.phoneNumber] || data[opts.phoneNumberVerified] === true || ctx.path === "/admin/update-user") return;
+					if (!ctx || data[opts.phoneNumber] == null || data[opts.phoneNumberVerified] === true || ctx.path === "/admin/update-user") return;
 					return { data: {
 						...data,
 						[opts.phoneNumber]: void 0

package/dist/plugins/two-factor/backup-codes/index.d.mts

@@ -170,7 +170,7 @@ export declare const backupCode2fa: (opts: BackupCodeOptions) => {
       };
     }, {
       token: string | undefined;
-      user: (Record<string, any> & {
+      user: ({
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -178,7 +178,7 @@ export declare const backupCode2fa: (opts: BackupCodeOptions) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      }) | UserWithTwoFactor;
+      } & Record<string, any>) | UserWithTwoFactor;
     }>;
     /**
      * ### Endpoint

package/dist/plugins/two-factor/index.d.mts

@@ -295,7 +295,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       };
     }, {
       token: string | undefined;
-      user: (Record<string, any> & {
+      user: ({
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -303,7 +303,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      }) | UserWithTwoFactor;
+      } & Record<string, any>) | UserWithTwoFactor;
     }>;
     generateBackupCodes: import("better-call").StrictEndpoint<"/two-factor/generate-backup-codes", {
       method: "POST";
@@ -490,7 +490,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -498,7 +498,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
     generateTOTP: import("better-call").StrictEndpoint<string, {
       method: "POST";
@@ -621,7 +621,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -629,7 +629,7 @@ export declare const twoFactor: <O extends TwoFactorOptions>(options?: O) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
   options: NoInfer<O>;

package/dist/plugins/two-factor/index.mjs

@@ -27,7 +27,7 @@ const signInPaths = /* @__PURE__ */ new Set([
 const signInTwoFactorStates = /* @__PURE__ */ new WeakMap();
 async function readSignInTwoFactorState(ctx, trustDeviceMaxAge) {
 	const data = ctx.context.newSession;
-	if (!signInPaths.has(ctx.path) || !data?.user.twoFactorEnabled) return {
+	if (!data?.user.twoFactorEnabled) return {
 		requiresTwoFactor: false,
 		trustDeviceCookie: null
 	};
@@ -90,6 +90,7 @@ const twoFactor = (options) => {
 		return state;
 	}
 	async function shouldRequireTwoFactor(ctx) {
+		if (!signInPaths.has(ctx.path)) return false;
 		return (await getSignInTwoFactorState(ctx)).requiresTwoFactor;
 	}
 	return {

package/dist/plugins/two-factor/otp/index.d.mts

@@ -198,7 +198,7 @@ export declare const otp2fa: (options?: OTPOptions | undefined) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -206,7 +206,7 @@ export declare const otp2fa: (options?: OTPOptions | undefined) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
 };

package/dist/plugins/two-factor/totp/index.d.mts

@@ -201,7 +201,7 @@ export declare const totp2fa: (options?: TOTPOptions | undefined) => {
       user: UserWithTwoFactor;
     } | {
       token: string;
-      user: Record<string, any> & {
+      user: {
         id: string;
         createdAt: Date;
         updatedAt: Date;
@@ -209,7 +209,7 @@ export declare const totp2fa: (options?: TOTPOptions | undefined) => {
         emailVerified: boolean;
         name: string;
         image?: string | null | undefined;
-      };
+      } & Record<string, any>;
     }>;
   };
 };

package/dist/plugins/two-factor/verify-two-factor.mjs

@@ -2,6 +2,7 @@ import { parseUserOutput } from "../../db/schema.mjs";
 import { generateRandomString } from "../../crypto/random.mjs";
 import { expireCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getAuthoritativeSessionFromCtx } from "../../api/routes/session.mjs";
+import { isSessionOutsideStore } from "../../api/state/session-source.mjs";
 import { TWO_FACTOR_ERROR_CODES } from "./error-code.mjs";
 import { TRUST_DEVICE_COOKIE_NAME, TWO_FACTOR_COOKIE_NAME } from "./constant.mjs";
 import { APIError } from "@better-auth/core/error";
@@ -11,7 +12,8 @@ async function verifyTwoFactor(ctx) {
 	const invalid = (errorKey) => {
 		throw APIError.from("UNAUTHORIZED", TWO_FACTOR_ERROR_CODES[errorKey]);
 	};
-	const session = await getAuthoritativeSessionFromCtx(ctx);
+	const requestSession = ctx.context.session;
+	const session = requestSession && await isSessionOutsideStore(requestSession.session.token) ? requestSession : await getAuthoritativeSessionFromCtx(ctx);
 	if (!session) {
 		const twoFactorCookie = ctx.context.createAuthCookie(TWO_FACTOR_COOKIE_NAME);
 		const signedTwoFactorCookie = await ctx.getSignedCookie(twoFactorCookie.name, ctx.context.secret);

package/dist/test-utils/test-instance.mjs

@@ -32,6 +32,8 @@ const testPassword = {
 async function getTestInstance(options, config) {
 	const testWith = config?.testWith || "sqlite";
 	const postgresSchema = testWith === "postgres" ? `ba_test_${randomUUID().replaceAll("-", "_")}` : void 0;
+	const mysqlServerURL = "mysql://root:root_password@127.0.0.1:3306";
+	const mysqlDatabase = testWith === "mysql" ? `ba_test_${randomUUID().replaceAll("-", "_")}` : void 0;
 	const quotePostgresIdentifier = (identifier) => `"${identifier.replaceAll("\"", "\"\"")}"`;
 	async function getPostgres() {
 		const { Kysely, PostgresDialect } = await import("kysely");
@@ -49,8 +51,14 @@ async function getTestInstance(options, config) {
 	}
 	async function getMysql() {
 		const { Kysely, MysqlDialect } = await import("kysely");
-		const { createPool } = await import("mysql2/promise");
-		return new Kysely({ dialect: new MysqlDialect({ pool: createPool("mysql://user:password@localhost:3306/better_auth") }) });
+		const { createConnection, createPool } = await import("mysql2");
+		const admin = createConnection(mysqlServerURL).promise();
+		try {
+			await admin.query(`CREATE DATABASE \`${mysqlDatabase}\``);
+		} finally {
+			await admin.end();
+		}
+		return new Kysely({ dialect: new MysqlDialect({ pool: createPool(`${mysqlServerURL}/${mysqlDatabase}`) }) });
 	}
 	async function mongodbClient() {
 		const { MongoClient } = await import("mongodb");
@@ -64,6 +72,9 @@ async function getTestInstance(options, config) {
 		};
 		return await dbClient("mongodb://127.0.0.1:27017", "better-auth");
 	}
+	const postgres = testWith === "postgres" ? await getPostgres() : void 0;
+	const mysql = testWith === "mysql" ? await getMysql() : void 0;
+	const sqlite = testWith === "sqlite" ? await getSqlite() : void 0;
 	const opts = {
 		socialProviders: {
 			github: {
@@ -76,20 +87,45 @@ async function getTestInstance(options, config) {
 			}
 		},
 		secret: "better-auth-secret-that-is-long-enough-for-validation-test",
-		database: testWith === "postgres" ? {
-			db: await getPostgres(),
+		database: postgres ? {
+			db: postgres,
 			type: "postgres",
 			transaction: config?.transaction
-		} : testWith === "mongodb" ? await Promise.all([mongodbClient(), await import("../adapters/mongodb-adapter/index.mjs")]).then(([db, { mongodbAdapter }]) => mongodbAdapter(db)) : testWith === "mysql" ? {
-			db: await getMysql(),
+		} : testWith === "mongodb" ? await Promise.all([mongodbClient(), await import("../adapters/mongodb-adapter/index.mjs")]).then(([db, { mongodbAdapter }]) => mongodbAdapter(db)) : mysql ? {
+			db: mysql,
 			type: "mysql",
 			transaction: config?.transaction
-		} : await getSqlite(),
+		} : sqlite,
 		emailAndPassword: { enabled: true },
 		rateLimit: { enabled: false },
 		advanced: { cookies: {} },
 		logger: { level: "debug" }
 	};
+	const cleanup = async () => {
+		if (testWith === "mongodb") {
+			await (await mongodbClient()).dropDatabase();
+			return;
+		}
+		if (postgres) {
+			try {
+				if (postgresSchema) await sql.raw(`DROP SCHEMA IF EXISTS ${quotePostgresIdentifier(postgresSchema)} CASCADE`).execute(postgres);
+				else await sql`DROP SCHEMA public CASCADE; CREATE SCHEMA public;`.execute(postgres);
+			} finally {
+				await postgres.destroy();
+			}
+			return;
+		}
+		if (mysql) {
+			try {
+				await sql.raw(`DROP DATABASE IF EXISTS \`${mysqlDatabase}\``).execute(mysql);
+			} finally {
+				await mysql.destroy();
+			}
+			return;
+		}
+		if (sqlite) sqlite.close();
+	};
+	cleanupSet.add(cleanup);
 	const authOptions = {
 		baseURL: "http://localhost:" + (config?.port || 3e3),
 		...opts,
@@ -126,32 +162,6 @@ async function getTestInstance(options, config) {
 		});
 	}
 	await createTestUser();
-	const cleanup = async () => {
-		if (testWith === "mongodb") {
-			await (await mongodbClient()).dropDatabase();
-			return;
-		}
-		if (testWith === "postgres") {
-			const postgres = await getPostgres();
-			if (postgresSchema) await sql.raw(`DROP SCHEMA IF EXISTS ${quotePostgresIdentifier(postgresSchema)} CASCADE`).execute(postgres);
-			else await sql`DROP SCHEMA public CASCADE; CREATE SCHEMA public;`.execute(postgres);
-			await postgres.destroy();
-			return;
-		}
-		if (testWith === "mysql") {
-			const mysql = await getMysql();
-			await sql`SET FOREIGN_KEY_CHECKS = 0;`.execute(mysql);
-			const tables = await mysql.introspection.getTables();
-			for (const table of tables) await mysql.deleteFrom(table.name).execute();
-			await sql`SET FOREIGN_KEY_CHECKS = 1;`.execute(mysql);
-			return;
-		}
-		if (testWith === "sqlite") {
-			(await getSqlite()).close();
-			return;
-		}
-	};
-	cleanupSet.add(cleanup);
 	const customFetchImpl = async (url, init) => {
 		const headers = init?.headers || {};
 		const storageHeaders = currentUserContextStorage.getStore()?.headers;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.16",
+  "version": "1.7.18",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -503,13 +503,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.16",
-    "@better-auth/drizzle-adapter": "1.7.16",
-    "@better-auth/kysely-adapter": "1.7.16",
-    "@better-auth/memory-adapter": "1.7.16",
-    "@better-auth/mongo-adapter": "1.7.16",
-    "@better-auth/prisma-adapter": "1.7.16",
-    "@better-auth/telemetry": "1.7.16"
+    "@better-auth/core": "1.7.18",
+    "@better-auth/drizzle-adapter": "1.7.18",
+    "@better-auth/kysely-adapter": "1.7.18",
+    "@better-auth/memory-adapter": "1.7.18",
+    "@better-auth/mongo-adapter": "1.7.18",
+    "@better-auth/prisma-adapter": "1.7.18",
+    "@better-auth/telemetry": "1.7.18"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -529,8 +529,8 @@
     "msw": "^2.14.6",
     "next": "^16.4.2",
     "oauth2-mock-server": "^9.0.0",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
     "solid-js": "^1.9.11",
     "tsdown": "0.23.1",
     "type-fest": "^5.7.0",