better-auth 1.7.2 → 1.7.3

package/dist/plugins/generic-oauth/providers/okta.mjs

@@ -22,20 +22,17 @@
 * ```
 */
 function okta(options) {
-	const defaultScopes = [
-		"openid",
-		"profile",
-		"email"
-	];
-	const issuer = options.issuer.replace(/\/$/, "");
 	return {
 		providerId: "okta",
-		accountIssuer: issuer,
-		discoveryUrl: `${issuer}/.well-known/openid-configuration`,
+		discoveryUrl: `${options.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,
-		scopes: options.scopes ?? defaultScopes,
+		scopes: options.scopes ?? [
+			"openid",
+			"profile",
+			"email"
+		],
 		redirectURI: options.redirectURI,
 		endSessionEndpoint: options.endSessionEndpoint,
 		postLogoutRedirectURI: options.postLogoutRedirectURI,

package/dist/plugins/generic-oauth/providers/slack.mjs

@@ -41,7 +41,6 @@ function slack(options) {
 	return {
 		providerId: "slack",
 		accountSubject: ({ profile }) => profile.sub ?? "",
-		accountIssuer: "https://slack.com",
 		authorizationUrl: "https://slack.com/openid/connect/authorize",
 		tokenUrl: "https://slack.com/api/openid.connect.token",
 		userInfoUrl: "https://slack.com/api/openid.connect.userInfo",

package/dist/plugins/generic-oauth/types.d.mts

@@ -36,15 +36,6 @@ interface GenericOAuthConfig<ID extends string = string> {
    * mapping cannot redefine provider identity.
    */
   accountSubject?: ((context: OAuthAccountKeyContext<GenericOAuthUserInfo>) => Awaitable<string | number>) | undefined;
-  /**
-   * Stable issuer namespace paired with the provider account ID.
-   *
-   * Discovery providers use the discovered issuer by default. Set this for
-   * providers without discovery, provider aliases that share one identity
-   * namespace, or tenant-specific issuers derived from verified provider data.
-   * The resolver must not use unverified request input.
-   */
-  accountIssuer?: string | ((context: OAuthAccountKeyContext<GenericOAuthUserInfo>) => Awaitable<string>) | undefined;
   /**
    * URL to fetch OAuth 2.0 configuration.
    * If provided, the authorization and token endpoints will be fetched from this URL.

package/dist/plugins/haveibeenpwned/index.d.mts

@@ -9,6 +9,14 @@ declare module "@better-auth/core" {
     };
   }
 }
+/**
+ * Checks whether a password appears in the Have I Been Pwned password corpus.
+ * Only the first five characters of its SHA-1 hash are sent to the service.
+ *
+ * @returns Whether the password has been compromised.
+ * @throws {APIError} When the password could not be checked.
+ */
+declare function isPasswordCompromised(password: string): Promise<boolean>;
 interface HaveIBeenPwnedOptions {
   /**
    * Custom error message shown when a compromised password is detected.
@@ -52,4 +60,4 @@ declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
   };
 };
 //#endregion
-export { HaveIBeenPwnedOptions, haveIBeenPwned };
+export { HaveIBeenPwnedOptions, haveIBeenPwned, isPasswordCompromised };

package/dist/plugins/haveibeenpwned/index.mjs

@@ -7,26 +7,46 @@ import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/haveibeenpwned/index.ts
 const ERROR_CODES = defineErrorCodes({ PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password." });
-async function checkPasswordCompromise(password, customMessage) {
-	if (!password) return;
-	const sha1Hash = (await createHash("SHA-1", "hex").digest(password)).toUpperCase();
-	const prefix = sha1Hash.substring(0, 5);
-	const suffix = sha1Hash.substring(5);
+function getPasswordCompromiseCount(response, hashSuffix) {
+	const matchingEntryPrefix = `${hashSuffix.toUpperCase()}:`;
+	for (const line of response.split(/\r?\n/)) {
+		if (line.slice(0, matchingEntryPrefix.length).toUpperCase() !== matchingEntryPrefix) continue;
+		const compromiseCountText = line.slice(matchingEntryPrefix.length);
+		const compromiseCount = Number(compromiseCountText);
+		if (!(Number.isSafeInteger(compromiseCount) && compromiseCount >= 0 && String(compromiseCount) === compromiseCountText)) throw new Error("Invalid password compromise count");
+		return compromiseCount;
+	}
+	return 0;
+}
+/**
+* Checks whether a password appears in the Have I Been Pwned password corpus.
+* Only the first five characters of its SHA-1 hash are sent to the service.
+*
+* @returns Whether the password has been compromised.
+* @throws {APIError} When the password could not be checked.
+*/
+async function isPasswordCompromised(password) {
 	try {
+		const sha1Hash = (await createHash("SHA-1", "hex").digest(password)).toUpperCase();
+		const prefix = sha1Hash.substring(0, 5);
+		const suffix = sha1Hash.substring(5);
 		const { data, error } = await betterFetch(`https://api.pwnedpasswords.com/range/${prefix}`, { headers: {
 			"Add-Padding": "true",
 			"User-Agent": "BetterAuth Password Checker"
 		} });
 		if (error) throw new APIError("INTERNAL_SERVER_ERROR", { message: `Failed to check password. Status: ${error.status}` });
-		if (data.split("\n").some((line) => line.split(":")[0].toUpperCase() === suffix.toUpperCase())) throw APIError.from("BAD_REQUEST", {
-			message: customMessage || ERROR_CODES.PASSWORD_COMPROMISED.message,
-			code: ERROR_CODES.PASSWORD_COMPROMISED.code
-		});
+		return getPasswordCompromiseCount(data, suffix) > 0;
 	} catch (error) {
 		if (isAPIError(error)) throw error;
 		throw new APIError("INTERNAL_SERVER_ERROR", { message: "Failed to check password. Please try again later." });
 	}
 }
+async function rejectCompromisedPassword(password, customMessage) {
+	if (await isPasswordCompromised(password)) throw APIError.from("BAD_REQUEST", {
+		message: customMessage || ERROR_CODES.PASSWORD_COMPROMISED.message,
+		code: ERROR_CODES.PASSWORD_COMPROMISED.code
+	});
+}
 const haveIBeenPwned = (options) => {
 	const paths = options?.paths || [
 		"/sign-up/email",
@@ -48,7 +68,7 @@ const haveIBeenPwned = (options) => {
 					if (options?.enabled === false) return originalHash(password);
 					const c = getCurrentAuthEndpointContext();
 					if (!c.path || !paths.includes(c.path)) return originalHash(password);
-					await checkPasswordCompromise(password, options?.customPasswordCompromisedMessage);
+					await rejectCompromisedPassword(password, options?.customPasswordCompromisedMessage);
 					return originalHash(password);
 				}
 			} } };
@@ -58,4 +78,4 @@ const haveIBeenPwned = (options) => {
 	};
 };
 //#endregion
-export { haveIBeenPwned };
+export { haveIBeenPwned, isPasswordCompromised };

package/dist/plugins/index.d.mts

@@ -31,7 +31,7 @@ import { PatreonOptions, patreon } from "./generic-oauth/providers/patreon.mjs";
 import { SlackOptions, slack } from "./generic-oauth/providers/slack.mjs";
 import { YandexOptions, yandex } from "./generic-oauth/providers/yandex.mjs";
 import { BaseOAuthProviderOptions, genericOAuth } from "./generic-oauth/index.mjs";
-import { HaveIBeenPwnedOptions, haveIBeenPwned } from "./haveibeenpwned/index.mjs";
+import { HaveIBeenPwnedOptions, haveIBeenPwned, isPasswordCompromised } from "./haveibeenpwned/index.mjs";
 import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./jwt/types.mjs";
 import { getJwtToken, resolveSigningKey, signJWT } from "./jwt/sign.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./jwt/utils.mjs";
@@ -66,4 +66,4 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/index.mjs

@@ -25,7 +25,7 @@ import { patreon } from "./generic-oauth/providers/patreon.mjs";
 import { slack } from "./generic-oauth/providers/slack.mjs";
 import { yandex } from "./generic-oauth/providers/yandex.mjs";
 import { genericOAuth } from "./generic-oauth/index.mjs";
-import { haveIBeenPwned } from "./haveibeenpwned/index.mjs";
+import { haveIBeenPwned, isPasswordCompromised } from "./haveibeenpwned/index.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./jwt/utils.mjs";
 import { getJwtToken, resolveSigningKey, signJWT } from "./jwt/sign.mjs";
 import { verifyJWT } from "./jwt/verify.mjs";
@@ -46,4 +46,4 @@ import { siwe } from "./siwe/index.mjs";
 import { testUtils } from "./test-utils/index.mjs";
 import { twoFactor } from "./two-factor/index.mjs";
 import { username } from "./username/index.mjs";
-export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, auth0, bearer, captcha, createAccessControl, createJwk, customSession, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateExportedKeyPair, genericOAuth, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, jwt, keycloak, lastLoginMethod, line, magicLink, microsoftEntraId, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, yandex };
+export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, auth0, bearer, captcha, createAccessControl, createJwk, customSession, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateExportedKeyPair, genericOAuth, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, microsoftEntraId, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, yandex };

package/dist/plugins/last-login-method/index.mjs

@@ -13,6 +13,7 @@ const lastLoginMethod = (userConfig) => {
 		if (path.includes("siwe")) return "siwe";
 		if (path.includes("/passkey/verify-authentication")) return "passkey";
 		if (path.startsWith("/magic-link/verify")) return "magic-link";
+		if (path === "/sign-in/email-otp") return "email-otp";
 		return null;
 	};
 	const getResolveContext = (ctx) => {

package/dist/plugins/oauth-proxy/index.d.mts

@@ -58,6 +58,10 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
   version: string;
   options: NoInfer<O>;
   endpoints: {
+    /**
+     * @deprecated OAuth proxy callbacks now use `/callback/:id/oauth-proxy`.
+     * This endpoint will be removed in the next minor release.
+     */
     oAuthProxy: _$better_call0.StrictEndpoint<"/oauth-proxy-callback", {
       method: "GET";
       operationId: string;
@@ -69,6 +73,7 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
       metadata: {
         openapi: {
           operationId: string;
+          deprecated: boolean;
           description: string;
           parameters: ({
             in: "query";
@@ -97,6 +102,18 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
         };
       };
     }, never>;
+    oAuthProxyCompletion: _$better_call0.StrictEndpoint<"/callback/:id/oauth-proxy", {
+      method: "GET";
+      operationId: string;
+      query: z.ZodObject<{
+        callbackURL: z.ZodString;
+        profile: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>[];
+      metadata: {
+        scope: "http";
+      };
+    }, never>;
   };
   hooks: {
     before: {

package/dist/plugins/oauth-proxy/index.mjs

@@ -8,22 +8,50 @@ import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/accou
 import { redirectOnError } from "../../oauth2/errors.mjs";
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { setOAuthState } from "../../api/state/oauth.mjs";
 import { parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
+import { accountSchema, userSchema } from "@better-auth/core/db";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { defu } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
 import * as z from "zod";
 //#region src/plugins/oauth-proxy/index.ts
-const consumeOAuthProxyState = async (ctx, state) => {
+/**
+* Passthrough payload containing OAuth profile data.
+* Used to transfer OAuth credentials from production to preview
+* without creating user/session on production.
+* @internal
+*/
+const passthroughPayloadSchema = z.looseObject({
+	userInfo: z.looseObject(userSchema.omit({
+		createdAt: true,
+		updatedAt: true
+	}).shape),
+	account: z.looseObject(accountSchema.omit({
+		id: true,
+		userId: true,
+		createdAt: true,
+		updatedAt: true
+	}).shape),
+	profile: z.record(z.string(), z.unknown()).optional(),
+	state: z.string().min(1),
+	callbackURL: z.string().min(1),
+	newUserURL: z.string().optional(),
+	errorURL: z.string().optional(),
+	disableSignUp: z.boolean().optional(),
+	timestamp: z.number()
+});
+const restoreOAuthProxyState = async (ctx, state) => {
 	try {
-		await parseGenericState(ctx, state, { skipStateCookieCheck: true });
-		return true;
+		const stateData = await parseGenericState(ctx, state, { skipStateCookieCheck: true });
+		await setOAuthState(stateData);
+		return stateData;
 	} catch (e) {
 		ctx.context.logger.warn("OAuth proxy state missing or invalid", e);
-		return false;
+		return null;
 	}
 };
 const oauthProxyQuerySchema = z.object({
@@ -38,104 +66,122 @@ const oauthCallbackQuerySchema = z.object({
 const oAuthProxy = (opts) => {
 	const maxAge = opts?.maxAge ?? 60;
 	const getEncryptionKey = (ctx) => opts?.secret ?? ctx.context.secretConfig;
+	const oauthProxyCompletion = createAuthEndpoint("/callback/:id/oauth-proxy", {
+		method: "GET",
+		operationId: "oauthProxyCompletion",
+		query: oauthProxyQuerySchema,
+		use: [originCheck((ctx) => ctx.query.callbackURL)],
+		metadata: { scope: "http" }
+	}, async (ctx) => {
+		const baseURLStr = typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : getOrigin(ctx.context.baseURL) || "";
+		const defaultErrorURL = ctx.context.options.onAPIError?.errorURL || `${stripTrailingSlash(baseURLStr)}/api/auth/error`;
+		const encryptedProfile = ctx.query.profile;
+		if (!encryptedProfile) {
+			ctx.context.logger.error("OAuth proxy callback missing profile data");
+			throw redirectOnError(ctx, defaultErrorURL, "missing_profile");
+		}
+		let decryptedPayload;
+		try {
+			decryptedPayload = await symmetricDecrypt({
+				key: getEncryptionKey(ctx),
+				data: encryptedProfile
+			});
+		} catch (e) {
+			ctx.context.logger.error("Failed to decrypt OAuth proxy profile", e);
+			throw redirectOnError(ctx, defaultErrorURL, "invalid_profile");
+		}
+		let payload;
+		try {
+			payload = passthroughPayloadSchema.parse(parseJSON(decryptedPayload));
+		} catch (e) {
+			ctx.context.logger.error("Failed to parse OAuth proxy payload", e);
+			throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
+		}
+		const errorURL = payload.errorURL || defaultErrorURL;
+		if (ctx.path?.startsWith("/callback/") && ctx.params.id !== payload.account.providerId) {
+			ctx.context.logger.warn("OAuth proxy callback provider mismatch");
+			throw redirectOnError(ctx, errorURL, "provider_mismatch");
+		}
+		const age = (Date.now() - payload.timestamp) / 1e3;
+		if (age > maxAge || age < -10) {
+			ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
+			throw redirectOnError(ctx, errorURL, "payload_expired");
+		}
+		if (!await restoreOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
+		let result;
+		try {
+			result = await handleOAuthUserInfo(ctx, {
+				userInfo: payload.userInfo,
+				account: payload.account,
+				callbackURL: payload.callbackURL,
+				disableSignUp: payload.disableSignUp,
+				source: {
+					method: "oauth",
+					oauth: {
+						providerId: payload.account.providerId,
+						profile: payload.profile
+					}
+				}
+			});
+		} catch (e) {
+			if (isAPIError(e) && e.body?.code) throw redirectOnError(ctx, errorURL, e.body.code, e.body.message);
+			throw e;
+		}
+		if (result.error) {
+			ctx.context.logger.error("OAuth proxy callback error", result.error);
+			throw redirectOnError(ctx, errorURL, result.error.split(" ").join("_"));
+		}
+		if (!result.data) {
+			ctx.context.logger.error("OAuth proxy callback missing session data");
+			throw redirectOnError(ctx, errorURL, "user_creation_failed");
+		}
+		await setSessionCookie(ctx, result.data);
+		const finalURL = result.isRegister ? payload.newUserURL || payload.callbackURL : payload.callbackURL;
+		throw ctx.redirect(finalURL);
+	});
 	return {
 		id: "oauth-proxy",
 		version: PACKAGE_VERSION,
 		options: opts,
-		endpoints: { oAuthProxy: createAuthEndpoint("/oauth-proxy-callback", {
-			method: "GET",
-			operationId: "oauthProxyCallback",
-			query: oauthProxyQuerySchema,
-			use: [originCheck((ctx) => ctx.query.callbackURL)],
-			metadata: { openapi: {
+		endpoints: {
+			/**
+			* @deprecated OAuth proxy callbacks now use `/callback/:id/oauth-proxy`.
+			* This endpoint will be removed in the next minor release.
+			*/
+			oAuthProxy: createAuthEndpoint("/oauth-proxy-callback", {
+				method: "GET",
 				operationId: "oauthProxyCallback",
-				description: "OAuth Proxy Callback",
-				parameters: [{
-					in: "query",
-					name: "callbackURL",
-					required: true,
-					description: "The URL to redirect to after the proxy"
-				}, {
-					in: "query",
-					name: "profile",
-					required: false,
-					description: "Encrypted OAuth profile data"
-				}],
-				responses: { 302: {
-					description: "Redirect",
-					headers: { Location: {
-						description: "The URL to redirect to",
-						schema: { type: "string" }
+				query: oauthProxyQuerySchema,
+				use: [originCheck((ctx) => ctx.query.callbackURL)],
+				metadata: { openapi: {
+					operationId: "oauthProxyCallback",
+					deprecated: true,
+					description: "OAuth Proxy Callback",
+					parameters: [{
+						in: "query",
+						name: "callbackURL",
+						required: true,
+						description: "The URL to redirect to after the proxy"
+					}, {
+						in: "query",
+						name: "profile",
+						required: false,
+						description: "Encrypted OAuth profile data"
+					}],
+					responses: { 302: {
+						description: "Redirect",
+						headers: { Location: {
+							description: "The URL to redirect to",
+							schema: { type: "string" }
+						} }
 					} }
 				} }
-			} }
-		}, async (ctx) => {
-			const baseURLStr = typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : getOrigin(ctx.context.baseURL) || "";
-			const defaultErrorURL = ctx.context.options.onAPIError?.errorURL || `${stripTrailingSlash(baseURLStr)}/api/auth/error`;
-			const encryptedProfile = ctx.query.profile;
-			if (!encryptedProfile) {
-				ctx.context.logger.error("OAuth proxy callback missing profile data");
-				throw redirectOnError(ctx, defaultErrorURL, "missing_profile");
-			}
-			let decryptedPayload;
-			try {
-				decryptedPayload = await symmetricDecrypt({
-					key: getEncryptionKey(ctx),
-					data: encryptedProfile
-				});
-			} catch (e) {
-				ctx.context.logger.error("Failed to decrypt OAuth proxy profile", e);
-				throw redirectOnError(ctx, defaultErrorURL, "invalid_profile");
-			}
-			let payload;
-			try {
-				payload = parseJSON(decryptedPayload);
-			} catch (e) {
-				ctx.context.logger.error("Failed to parse OAuth proxy payload", e);
-				throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
-			}
-			if (typeof payload.timestamp !== "number" || !payload.userInfo || !payload.account || !payload.state || !payload.callbackURL) {
-				ctx.context.logger.error("Failed to parse OAuth proxy payload");
-				throw redirectOnError(ctx, defaultErrorURL, "invalid_payload");
-			}
-			const errorURL = payload.errorURL || defaultErrorURL;
-			const age = (Date.now() - payload.timestamp) / 1e3;
-			if (age > maxAge || age < -10) {
-				ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
-				throw redirectOnError(ctx, errorURL, "payload_expired");
-			}
-			if (!await consumeOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
-			let result;
-			try {
-				result = await handleOAuthUserInfo(ctx, {
-					userInfo: payload.userInfo,
-					account: payload.account,
-					callbackURL: payload.callbackURL,
-					disableSignUp: payload.disableSignUp,
-					source: {
-						method: "oauth",
-						oauth: {
-							providerId: payload.account.providerId,
-							profile: payload.profile
-						}
-					}
-				});
-			} catch (e) {
-				if (isAPIError(e) && e.body?.code) throw redirectOnError(ctx, errorURL, e.body.code, e.body.message);
-				throw e;
-			}
-			if (result.error) {
-				ctx.context.logger.error("OAuth proxy callback error", result.error);
-				throw redirectOnError(ctx, errorURL, result.error.split(" ").join("_"));
-			}
-			if (!result.data) {
-				ctx.context.logger.error("OAuth proxy callback missing session data");
-				throw redirectOnError(ctx, errorURL, "user_creation_failed");
-			}
-			await setSessionCookie(ctx, result.data);
-			const finalURL = result.isRegister ? payload.newUserURL || payload.callbackURL : payload.callbackURL;
-			throw ctx.redirect(finalURL);
-		}) },
+			}, async (ctx) => oauthProxyCompletion({
+				...ctx,
+				params: { id: "oauth-proxy" }
+			})),
+			oAuthProxyCompletion: oauthProxyCompletion
+		},
 		hooks: {
 			before: [{
 				matcher(context) {
@@ -143,6 +189,8 @@ const oAuthProxy = (opts) => {
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					if (checkSkipProxy(ctx, opts)) return;
+					const providerId = ctx.body?.provider;
+					if (!providerId) return;
 					const currentURL = resolveCurrentURL(ctx, opts);
 					const productionURL = opts?.productionURL;
 					const originalCallbackURL = ctx.body?.callbackURL || ctx.context.baseURL;
@@ -150,8 +198,7 @@ const oAuthProxy = (opts) => {
 						const productionBaseURL = `${stripTrailingSlash(productionURL)}${ctx.context.options.basePath || "/api/auth"}`;
 						ctx.context.baseURL = productionBaseURL;
 					}
-					const newCallbackURL = `${stripTrailingSlash(currentURL.origin)}${ctx.context.options.basePath || "/api/auth"}/oauth-proxy-callback?callbackURL=${encodeURIComponent(originalCallbackURL)}`;
-					if (!ctx.body) return;
+					const newCallbackURL = `${stripTrailingSlash(currentURL.origin)}${ctx.context.options.basePath || "/api/auth"}/callback/${providerId}/oauth-proxy?callbackURL=${encodeURIComponent(originalCallbackURL)}`;
 					ctx.body.callbackURL = newCallbackURL;
 				})
 			}, {
@@ -261,7 +308,6 @@ const oAuthProxy = (opts) => {
 						},
 						profile: providerProfile,
 						account: {
-							providerId: provider.id,
 							...accountKey,
 							accessToken: tokens.accessToken,
 							refreshToken: tokens.refreshToken,
@@ -342,7 +388,7 @@ const oAuthProxy = (opts) => {
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					const location = ctx.context.responseHeaders?.get("location");
-					if (!location?.includes("/oauth-proxy-callback?callbackURL") || !location.startsWith("http")) return;
+					if (!location?.includes("/oauth-proxy?callbackURL") && !location?.includes("/oauth-proxy-callback?callbackURL") || !location.startsWith("http")) return;
 					const productionOrigin = getOrigin(opts?.productionURL || (typeof ctx.context.options.baseURL === "string" ? ctx.context.options.baseURL : void 0) || ctx.context.baseURL);
 					const locationURL = new URL(location);
 					if (locationURL.origin === productionOrigin) {

package/dist/plugins/one-tap/index.mjs

@@ -71,7 +71,6 @@ const oneTap = (options) => ({
 			},
 			account: {
 				providerId: "google",
-				issuer: "https://accounts.google.com",
 				accountId: sub,
 				idToken,
 				scope: "openid,profile,email"

package/dist/plugins/open-api/generator.mjs

@@ -113,6 +113,20 @@ function schemaAcceptsUndefined(zodType) {
 	}
 	return false;
 }
+/**
+* Resolve input optionality exactly as Zod's JSON Schema emitter does.
+*
+* @see https://github.com/colinhacks/zod/blob/v4.5.4/packages/zod/src/v4/core/json-schema-processors.ts#L294-L308
+*/
+function getZodInputOptionality(zodType) {
+	const def = zodType._zod.def;
+	if (def.type === "pipe") {
+		const pipeDef = def;
+		if (pipeDef.in._zod.traits.has("$ZodTransform")) return getZodInputOptionality(pipeDef.out);
+	}
+	if (def.type === "catch") return getZodInputOptionality(def.innerType);
+	return zodType._zod.optin;
+}
 function isUndefinedOnlySchema(zodType) {
 	return zodType instanceof z.ZodUndefined || zodType instanceof z.ZodVoid;
 }
@@ -252,7 +266,7 @@ function toOpenApiSchema(zodType) {
 			Object.entries(shape).forEach(([key, value]) => {
 				if (value instanceof z.ZodType) {
 					properties[key] = toOpenApiSchema(value);
-					if (!schemaAcceptsUndefined(value)) required.push(key);
+					if (getZodInputOptionality(value) === void 0) required.push(key);
 				}
 			});
 			return withDescription({

package/dist/plugins/open-api/index.mjs

@@ -1,5 +1,4 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import "../../utils/index.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { generator } from "./generator.mjs";

package/dist/plugins/organization/has-permission.mjs

@@ -3,6 +3,7 @@ import { defaultRoles } from "./access/statement.mjs";
 import { cacheAllRoles, hasPermissionFn } from "./permission.mjs";
 import * as z from "zod";
 //#region src/plugins/organization/has-permission.ts
+const rolePermissionsSchema = z.record(z.string(), z.array(z.string()));
 const hasPermission = async (input, ctx) => {
 	let acRoles = { ...input.options.roles || defaultRoles };
 	if (ctx && input.organizationId && input.options.dynamicAccessControl?.enabled && input.options.ac && !input.useMemoryCache) {
@@ -14,9 +15,10 @@ const hasPermission = async (input, ctx) => {
 			}]
 		});
 		for (const { role, permission: permissionsString } of roles) {
-			const result = z.record(z.string(), z.array(z.string())).safeParse(JSON.parse(permissionsString));
+			const permissions = JSON.parse(permissionsString);
+			const result = rolePermissionsSchema.safeParse(permissions);
 			if (!result.success) {
-				ctx.context.logger.error("[hasPermission] Invalid permissions for role " + role, { permissions: JSON.parse(permissionsString) });
+				ctx.context.logger.error("[hasPermission] Invalid permissions for role " + role, { permissions });
 				throw new APIError("INTERNAL_SERVER_ERROR", { message: "Invalid permissions for role " + role });
 			}
 			const merged = { ...acRoles[role]?.statements };

package/dist/plugins/phone-number/routes.mjs

@@ -4,9 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import "../../utils/index.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
-import { createLocalAccountIssuer } from "@better-auth/core/db";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -476,7 +474,6 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 	if (!await ctx.context.internalAdapter.findCredentialAccount(user.id)) await ctx.context.internalAdapter.createAccount({
 		userId: user.id,
 		providerId: "credential",
-		issuer: createLocalAccountIssuer("credential"),
 		accountId: user.id,
 		password: hashedPassword
 	});