better-auth 1.7.2 → 1.7.4

package/dist/plugins/generic-oauth/index.mjs

@@ -93,7 +93,6 @@ const genericOAuth = (options) => {
 						return null;
 					});
 					if (discovered) {
-						if (!discovered.issuer && !c.accountIssuer) throw new Error(`Provider "${c.providerId}": discovery did not return an issuer. Configure accountIssuer explicitly to establish a stable account namespace.`);
 						authorizationUrl ??= discovered.authorization_endpoint;
 						tokenUrl ??= discovered.token_endpoint;
 						userInfoUrl ??= discovered.userinfo_endpoint;
@@ -106,7 +105,8 @@ const genericOAuth = (options) => {
 							try {
 								jwksUrl = new URL(discovered.jwks_uri, c.discoveryUrl);
 							} catch {
-								throw new Error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document.`);
+								ctx.logger.error(`Provider "${c.providerId}": invalid jwks_uri "${discovered.jwks_uri}" in discovery document. Provider skipped.`);
+								continue;
 							}
 							idTokenConfig = {
 								jwks: createRemoteJWKSet(jwksUrl),
@@ -115,16 +115,24 @@ const genericOAuth = (options) => {
 								algorithms: isOidc ? signingAlgs : void 0
 							};
 						}
-					} else if (!c.accountIssuer) throw new Error(`Provider "${c.providerId}": discovery returned no valid data. Provider initialization stopped to keep its account issuer stable.`);
-					else if (!authorizationUrl || !tokenUrl) ctx.logger.error(`Provider "${c.providerId}": discovery returned no data and no explicit endpoints configured. OAuth sign-in will fail for this provider.`);
+					}
+					if (!authorizationUrl || !tokenUrl && !c.getToken) {
+						ctx.logger.error(`Provider "${c.providerId}": discovery left no usable authorization endpoint or token exchange. Provider skipped.`);
+						continue;
+					}
+				}
+				if (c.requireIdTokenVerification && !idTokenConfig) {
+					if (c.discoveryUrl) {
+						ctx.logger.error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri. Provider skipped.`);
+						continue;
+					}
+					throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
 				}
-				if (c.requireIdTokenVerification && !idTokenConfig) throw new Error(`Provider "${c.providerId}": requires verified ID tokens, but discovery did not provide a usable issuer and jwks_uri.`);
 				const tokenEndpointAuth = c.tokenEndpointAuth;
 				if (c.clientSecret && isSecretlessTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" cannot be combined with clientSecret`);
 				if (!c.clientSecret && isClientSecretTokenEndpointAuth(tokenEndpointAuth)) throw new Error(`Provider "${c.providerId}": tokenEndpointAuth.method "${tokenEndpointAuth?.method}" requires clientSecret`);
 				if (!c.clientSecret && !tokenEndpointAuth && c.authentication === "basic") throw new Error(`Provider "${c.providerId}": authentication "basic" requires clientSecret`);
 				const accountSubject = c.accountSubject;
-				const accountIssuer = c.accountIssuer;
 				const provider = {
 					id: c.providerId,
 					name: c.name ?? c.providerId,
@@ -137,10 +145,6 @@ const genericOAuth = (options) => {
 						});
 						return isOidc ? genericProfile.sub ?? "" : genericProfile.id ?? "";
 					},
-					accountIssuer: typeof accountIssuer === "function" ? ({ tokens, profile }) => accountIssuer({
-						tokens,
-						profile
-					}) : accountIssuer ?? issuer,
 					idToken: idTokenConfig,
 					requiresIdTokenNonce: idTokenConfig !== void 0 && c.disableIdTokenNonceBinding !== true,
 					allowIdpInitiated: c.allowIdpInitiated,

package/dist/plugins/generic-oauth/providers/auth0.mjs

@@ -27,12 +27,10 @@ function auth0(options) {
 		"profile",
 		"email"
 	];
-	const domain = options.domain.replace(/^https?:\/\//, "").replace(/\/+$/, "");
-	const discoveryUrl = `https://${domain}/.well-known/openid-configuration`;
+	const domainUrl = options.domain.startsWith("http://") || options.domain.startsWith("https://") ? options.domain : `https://${options.domain}`;
 	return {
 		providerId: "auth0",
-		accountIssuer: `https://${domain}/`,
-		discoveryUrl,
+		discoveryUrl: `https://${new URL(domainUrl).host}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,

package/dist/plugins/generic-oauth/providers/keycloak.mjs

@@ -22,20 +22,17 @@
 * ```
 */
 function keycloak(options) {
-	const defaultScopes = [
-		"openid",
-		"profile",
-		"email"
-	];
-	const issuer = options.issuer.replace(/\/$/, "");
 	return {
 		providerId: "keycloak",
-		accountIssuer: issuer,
-		discoveryUrl: `${issuer}/.well-known/openid-configuration`,
+		discoveryUrl: `${options.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,
-		scopes: options.scopes ?? defaultScopes,
+		scopes: options.scopes ?? [
+			"openid",
+			"profile",
+			"email"
+		],
 		redirectURI: options.redirectURI,
 		endSessionEndpoint: options.endSessionEndpoint,
 		postLogoutRedirectURI: options.postLogoutRedirectURI,

package/dist/plugins/generic-oauth/providers/line.mjs

@@ -71,7 +71,6 @@ function line(options) {
 	return {
 		providerId: options.providerId ?? "line",
 		accountSubject: ({ profile }) => profile.sub ?? "",
-		accountIssuer: "https://access.line.me",
 		authorizationUrl,
 		tokenUrl,
 		userInfoUrl,

package/dist/plugins/generic-oauth/providers/okta.mjs

@@ -22,20 +22,17 @@
 * ```
 */
 function okta(options) {
-	const defaultScopes = [
-		"openid",
-		"profile",
-		"email"
-	];
-	const issuer = options.issuer.replace(/\/$/, "");
 	return {
 		providerId: "okta",
-		accountIssuer: issuer,
-		discoveryUrl: `${issuer}/.well-known/openid-configuration`,
+		discoveryUrl: `${options.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`,
 		clientId: options.clientId,
 		clientSecret: options.clientSecret,
 		tokenEndpointAuth: options.tokenEndpointAuth,
-		scopes: options.scopes ?? defaultScopes,
+		scopes: options.scopes ?? [
+			"openid",
+			"profile",
+			"email"
+		],
 		redirectURI: options.redirectURI,
 		endSessionEndpoint: options.endSessionEndpoint,
 		postLogoutRedirectURI: options.postLogoutRedirectURI,

package/dist/plugins/generic-oauth/providers/slack.mjs

@@ -41,7 +41,6 @@ function slack(options) {
 	return {
 		providerId: "slack",
 		accountSubject: ({ profile }) => profile.sub ?? "",
-		accountIssuer: "https://slack.com",
 		authorizationUrl: "https://slack.com/openid/connect/authorize",
 		tokenUrl: "https://slack.com/api/openid.connect.token",
 		userInfoUrl: "https://slack.com/api/openid.connect.userInfo",

package/dist/plugins/generic-oauth/types.d.mts

@@ -36,15 +36,6 @@ interface GenericOAuthConfig<ID extends string = string> {
    * mapping cannot redefine provider identity.
    */
   accountSubject?: ((context: OAuthAccountKeyContext<GenericOAuthUserInfo>) => Awaitable<string | number>) | undefined;
-  /**
-   * Stable issuer namespace paired with the provider account ID.
-   *
-   * Discovery providers use the discovered issuer by default. Set this for
-   * providers without discovery, provider aliases that share one identity
-   * namespace, or tenant-specific issuers derived from verified provider data.
-   * The resolver must not use unverified request input.
-   */
-  accountIssuer?: string | ((context: OAuthAccountKeyContext<GenericOAuthUserInfo>) => Awaitable<string>) | undefined;
   /**
    * URL to fetch OAuth 2.0 configuration.
    * If provided, the authorization and token endpoints will be fetched from this URL.

package/dist/plugins/haveibeenpwned/index.d.mts

@@ -9,6 +9,14 @@ declare module "@better-auth/core" {
     };
   }
 }
+/**
+ * Checks whether a password appears in the Have I Been Pwned password corpus.
+ * Only the first five characters of its SHA-1 hash are sent to the service.
+ *
+ * @returns Whether the password has been compromised.
+ * @throws {APIError} When the password could not be checked.
+ */
+declare function isPasswordCompromised(password: string): Promise<boolean>;
 interface HaveIBeenPwnedOptions {
   /**
    * Custom error message shown when a compromised password is detected.
@@ -52,4 +60,4 @@ declare const haveIBeenPwned: (options?: HaveIBeenPwnedOptions | undefined) => {
   };
 };
 //#endregion
-export { HaveIBeenPwnedOptions, haveIBeenPwned };
+export { HaveIBeenPwnedOptions, haveIBeenPwned, isPasswordCompromised };

package/dist/plugins/haveibeenpwned/index.mjs

@@ -7,26 +7,46 @@ import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/haveibeenpwned/index.ts
 const ERROR_CODES = defineErrorCodes({ PASSWORD_COMPROMISED: "The password you entered has been compromised. Please choose a different password." });
-async function checkPasswordCompromise(password, customMessage) {
-	if (!password) return;
-	const sha1Hash = (await createHash("SHA-1", "hex").digest(password)).toUpperCase();
-	const prefix = sha1Hash.substring(0, 5);
-	const suffix = sha1Hash.substring(5);
+function getPasswordCompromiseCount(response, hashSuffix) {
+	const matchingEntryPrefix = `${hashSuffix.toUpperCase()}:`;
+	for (const line of response.split(/\r?\n/)) {
+		if (line.slice(0, matchingEntryPrefix.length).toUpperCase() !== matchingEntryPrefix) continue;
+		const compromiseCountText = line.slice(matchingEntryPrefix.length);
+		const compromiseCount = Number(compromiseCountText);
+		if (!(Number.isSafeInteger(compromiseCount) && compromiseCount >= 0 && String(compromiseCount) === compromiseCountText)) throw new Error("Invalid password compromise count");
+		return compromiseCount;
+	}
+	return 0;
+}
+/**
+* Checks whether a password appears in the Have I Been Pwned password corpus.
+* Only the first five characters of its SHA-1 hash are sent to the service.
+*
+* @returns Whether the password has been compromised.
+* @throws {APIError} When the password could not be checked.
+*/
+async function isPasswordCompromised(password) {
 	try {
+		const sha1Hash = (await createHash("SHA-1", "hex").digest(password)).toUpperCase();
+		const prefix = sha1Hash.substring(0, 5);
+		const suffix = sha1Hash.substring(5);
 		const { data, error } = await betterFetch(`https://api.pwnedpasswords.com/range/${prefix}`, { headers: {
 			"Add-Padding": "true",
 			"User-Agent": "BetterAuth Password Checker"
 		} });
 		if (error) throw new APIError("INTERNAL_SERVER_ERROR", { message: `Failed to check password. Status: ${error.status}` });
-		if (data.split("\n").some((line) => line.split(":")[0].toUpperCase() === suffix.toUpperCase())) throw APIError.from("BAD_REQUEST", {
-			message: customMessage || ERROR_CODES.PASSWORD_COMPROMISED.message,
-			code: ERROR_CODES.PASSWORD_COMPROMISED.code
-		});
+		return getPasswordCompromiseCount(data, suffix) > 0;
 	} catch (error) {
 		if (isAPIError(error)) throw error;
 		throw new APIError("INTERNAL_SERVER_ERROR", { message: "Failed to check password. Please try again later." });
 	}
 }
+async function rejectCompromisedPassword(password, customMessage) {
+	if (await isPasswordCompromised(password)) throw APIError.from("BAD_REQUEST", {
+		message: customMessage || ERROR_CODES.PASSWORD_COMPROMISED.message,
+		code: ERROR_CODES.PASSWORD_COMPROMISED.code
+	});
+}
 const haveIBeenPwned = (options) => {
 	const paths = options?.paths || [
 		"/sign-up/email",
@@ -48,7 +68,7 @@ const haveIBeenPwned = (options) => {
 					if (options?.enabled === false) return originalHash(password);
 					const c = getCurrentAuthEndpointContext();
 					if (!c.path || !paths.includes(c.path)) return originalHash(password);
-					await checkPasswordCompromise(password, options?.customPasswordCompromisedMessage);
+					await rejectCompromisedPassword(password, options?.customPasswordCompromisedMessage);
 					return originalHash(password);
 				}
 			} } };
@@ -58,4 +78,4 @@ const haveIBeenPwned = (options) => {
 	};
 };
 //#endregion
-export { haveIBeenPwned };
+export { haveIBeenPwned, isPasswordCompromised };

package/dist/plugins/index.d.mts

@@ -31,7 +31,7 @@ import { PatreonOptions, patreon } from "./generic-oauth/providers/patreon.mjs";
 import { SlackOptions, slack } from "./generic-oauth/providers/slack.mjs";
 import { YandexOptions, yandex } from "./generic-oauth/providers/yandex.mjs";
 import { BaseOAuthProviderOptions, genericOAuth } from "./generic-oauth/index.mjs";
-import { HaveIBeenPwnedOptions, haveIBeenPwned } from "./haveibeenpwned/index.mjs";
+import { HaveIBeenPwnedOptions, haveIBeenPwned, isPasswordCompromised } from "./haveibeenpwned/index.mjs";
 import { JWKOptions, JWSAlgorithms, Jwk, JwtOptions, ResolvedSigningKey } from "./jwt/types.mjs";
 import { getJwtToken, resolveSigningKey, signJWT } from "./jwt/sign.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./jwt/utils.mjs";
@@ -53,7 +53,7 @@ import { OpenAPIOptions, openAPI } from "./open-api/index.mjs";
 import { PhoneNumberOptions, UserWithPhoneNumber } from "./phone-number/types.mjs";
 import { phoneNumber } from "./phone-number/index.mjs";
 import { SIWEPluginOptions, siwe } from "./siwe/index.mjs";
-import { LoginResult, TestCookie, TestHelpers, TestUtilsOptions } from "./test-utils/types.mjs";
+import { LoginResult, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions } from "./test-utils/types.mjs";
 import { testUtils } from "./test-utils/index.mjs";
 import { BackupCodeOptions, backupCode2fa, encodeBackupCodes, generateBackupCodes, getBackupCodes, verifyBackupCode } from "./two-factor/backup-codes/index.mjs";
 import { OTPOptions, otp2fa } from "./two-factor/otp/index.mjs";
@@ -66,4 +66,4 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/index.mjs

@@ -25,7 +25,7 @@ import { patreon } from "./generic-oauth/providers/patreon.mjs";
 import { slack } from "./generic-oauth/providers/slack.mjs";
 import { yandex } from "./generic-oauth/providers/yandex.mjs";
 import { genericOAuth } from "./generic-oauth/index.mjs";
-import { haveIBeenPwned } from "./haveibeenpwned/index.mjs";
+import { haveIBeenPwned, isPasswordCompromised } from "./haveibeenpwned/index.mjs";
 import { createJwk, generateExportedKeyPair, toExpJWT } from "./jwt/utils.mjs";
 import { getJwtToken, resolveSigningKey, signJWT } from "./jwt/sign.mjs";
 import { verifyJWT } from "./jwt/verify.mjs";
@@ -46,4 +46,4 @@ import { siwe } from "./siwe/index.mjs";
 import { testUtils } from "./test-utils/index.mjs";
 import { twoFactor } from "./two-factor/index.mjs";
 import { username } from "./username/index.mjs";
-export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, auth0, bearer, captcha, createAccessControl, createJwk, customSession, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateExportedKeyPair, genericOAuth, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, jwt, keycloak, lastLoginMethod, line, magicLink, microsoftEntraId, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, yandex };
+export { MULTI_SESSION_ERROR_CODES as ERROR_CODES, HIDE_METADATA, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, POPUP_MARKER_COOKIE, TWO_FACTOR_ERROR_CODES, USERNAME_ERROR_CODES, admin, anonymous, auth0, bearer, captcha, createAccessControl, createJwk, customSession, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, generateExportedKeyPair, genericOAuth, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, microsoftEntraId, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, signJWT, siwe, slack, testUtils, toExpJWT, twoFactor, twoFactorClient, username, verifyJWT, yandex };

package/dist/plugins/last-login-method/index.mjs

@@ -13,6 +13,7 @@ const lastLoginMethod = (userConfig) => {
 		if (path.includes("siwe")) return "siwe";
 		if (path.includes("/passkey/verify-authentication")) return "passkey";
 		if (path.startsWith("/magic-link/verify")) return "magic-link";
+		if (path === "/sign-in/email-otp") return "email-otp";
 		return null;
 	};
 	const getResolveContext = (ctx) => {

package/dist/plugins/oauth-proxy/index.d.mts

@@ -58,6 +58,10 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
   version: string;
   options: NoInfer<O>;
   endpoints: {
+    /**
+     * @deprecated OAuth proxy callbacks now use `/callback/:id/oauth-proxy`.
+     * This endpoint will be removed in the next minor release.
+     */
     oAuthProxy: _$better_call0.StrictEndpoint<"/oauth-proxy-callback", {
       method: "GET";
       operationId: string;
@@ -69,6 +73,7 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
       metadata: {
         openapi: {
           operationId: string;
+          deprecated: boolean;
           description: string;
           parameters: ({
             in: "query";
@@ -97,6 +102,18 @@ declare const oAuthProxy: <O extends OAuthProxyOptions>(opts?: O) => {
         };
       };
     }, never>;
+    oAuthProxyCompletion: _$better_call0.StrictEndpoint<"/callback/:id/oauth-proxy", {
+      method: "GET";
+      operationId: string;
+      query: z.ZodObject<{
+        callbackURL: z.ZodString;
+        profile: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+      use: _$better_call0.Middleware<_$better_call0.MiddlewareOptions, (inputContext: _$better_call0.MiddlewareInputContext<_$better_call0.MiddlewareOptions>) => Promise<void>>[];
+      metadata: {
+        scope: "http";
+      };
+    }, never>;
   };
   hooks: {
     before: {