better-auth 1.7.4 → 1.7.6

package/dist/cookies/index.mjs

@@ -268,6 +268,10 @@ const getSessionCookie = (request, config) => {
 	if (sessionToken) return sessionToken;
 	return null;
 };
+async function matchesVersion(payload, version) {
+	const expectedVersion = typeof version === "string" ? version : await version(payload.session, payload.user);
+	return (payload.version || "1") === expectedVersion;
+}
 const getCookieCache = async (request, config) => {
 	const cookies = (request instanceof Headers || !("headers" in request) ? request : request.headers).get("cookie");
 	if (!cookies) return null;
@@ -297,21 +301,12 @@ const getCookieCache = async (request, config) => {
 			const secret = config?.secret || env.BETTER_AUTH_SECRET;
 			if (!secret) throw new BetterAuthError("getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable");
 			const payload = parseCookieCachePayload(await symmetricDecodeJWT(sessionData, secret, "better-auth-session"));
-			if (payload) {
-				if (config?.version) {
-					const cookieVersion = payload.version || "1";
-					let expectedVersion = "1";
-					if (typeof config.version === "string") expectedVersion = config.version;
-					else if (typeof config.version === "function") {
-						const result = config.version(payload.session, payload.user);
-						expectedVersion = isPromise(result) ? await result : result;
-					}
-					if (cookieVersion !== expectedVersion) return null;
-				}
-				if (isEmbeddedSessionExpired(payload.session)) return null;
-				return payload;
+			if (!payload) return null;
+			if (config?.version) {
+				if (!await matchesVersion(payload, config.version)) return null;
 			}
-			return null;
+			if (isEmbeddedSessionExpired(payload.session)) return null;
+			return payload;
 		} else if (strategy === "jwt") {
 			const jwks = config?.jwt?.jwks;
 			let payload;
@@ -324,21 +319,12 @@ const getCookieCache = async (request, config) => {
 				if (!secret) throw new BetterAuthError("getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable");
 				payload = parseCookieCachePayload(await verifyJWT(sessionData, secret));
 			}
-			if (payload) {
-				if (config?.version) {
-					const cookieVersion = payload.version || "1";
-					let expectedVersion = "1";
-					if (typeof config.version === "string") expectedVersion = config.version;
-					else if (typeof config.version === "function") {
-						const result = config.version(payload.session, payload.user);
-						expectedVersion = isPromise(result) ? await result : result;
-					}
-					if (cookieVersion !== expectedVersion) return null;
-				}
-				if (isEmbeddedSessionExpired(payload.session)) return null;
-				return payload;
+			if (!payload) return null;
+			if (config?.version) {
+				if (!await matchesVersion(payload, config.version)) return null;
 			}
-			return null;
+			if (isEmbeddedSessionExpired(payload.session)) return null;
+			return payload;
 		} else {
 			const secret = config?.secret || env.BETTER_AUTH_SECRET;
 			if (!secret) throw new BetterAuthError("getCookieCache requires a secret to be provided. Either pass it as an option or set the BETTER_AUTH_SECRET environment variable");
@@ -351,14 +337,7 @@ const getCookieCache = async (request, config) => {
 			const payload = parseCookieCachePayload(sessionDataPayload.session);
 			if (!payload) return null;
 			if (config?.version) {
-				const cookieVersion = payload.version || "1";
-				let expectedVersion = "1";
-				if (typeof config.version === "string") expectedVersion = config.version;
-				else if (typeof config.version === "function") {
-					const result = config.version(payload.session, payload.user);
-					expectedVersion = isPromise(result) ? await result : result;
-				}
-				if (cookieVersion !== expectedVersion) return null;
+				if (!await matchesVersion(payload, config.version)) return null;
 			}
 			if (typeof sessionDataPayload.expiresAt === "number" && sessionDataPayload.expiresAt < Date.now()) return null;
 			if (isEmbeddedSessionExpired(payload.session)) return null;

package/dist/db/get-migration.mjs

@@ -115,10 +115,12 @@ function toDatabaseIndexMap(indexes) {
 		}];
 	}));
 }
-async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspectIndexes) {
+async function getDatabaseIndexMap(db, target, tableNames, introspectIndexes) {
 	if (introspectIndexes) return toDatabaseIndexMap(await introspectIndexes(tableNames));
 	let rows;
-	if (dbType === "sqlite") rows = (await sql`
+	switch (target.type) {
+		case "sqlite":
+			rows = (await sql`
 				SELECT
 					tables.name AS "tableName",
 					index_list.name AS "indexName",
@@ -131,7 +133,9 @@ async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspec
 				INNER JOIN pragma_index_info(index_list.name) AS index_info
 				WHERE tables.type = 'table'
 			`.execute(db)).rows;
-	else if (dbType === "postgres") rows = (await sql`
+			break;
+		case "postgres":
+			rows = (await sql`
 				SELECT
 					table_class.relname AS "tableName",
 					index_class.relname AS "indexName",
@@ -153,11 +157,13 @@ async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspec
 				LEFT JOIN pg_attribute AS index_attribute
 					ON index_attribute.attrelid = table_class.oid
 					AND index_attribute.attnum = index_column.attribute_number
-				WHERE table_namespace.nspname = ${schemaName}
+				WHERE table_namespace.nspname = ${target.schema}
 					AND table_class.relkind = 'r'
 					AND index_column.ordinality <= index_data.indnkeyatts
 			`.execute(db)).rows;
-	else if (dbType === "mysql") rows = (await sql`
+			break;
+		case "mysql":
+			rows = (await sql`
 				SELECT
 					table_name AS tableName,
 					index_name AS indexName,
@@ -169,7 +175,9 @@ async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspec
 				FROM information_schema.statistics
 				WHERE table_schema = DATABASE()
 			`.execute(db)).rows;
-	else rows = (await sql`
+			break;
+		case "mssql":
+			rows = (await sql`
 				SELECT
 					tables.name AS "tableName",
 					indexes.name AS "indexName",
@@ -190,10 +198,12 @@ async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspec
 				INNER JOIN sys.columns AS columns
 					ON columns.object_id = index_columns.object_id
 					AND columns.column_id = index_columns.column_id
-				WHERE table_schemas.name = ${schemaName}
+				WHERE table_schemas.name = ${target.schema}
 					AND indexes.name IS NOT NULL
 					AND index_columns.key_ordinal > 0
 			`.execute(db)).rows;
+			break;
+	}
 	const indexMetadata = /* @__PURE__ */ new Map();
 	for (const row of rows) {
 		const table = row.tableName ?? row.table_name ?? row.TABLE_NAME ?? row.tablename ?? row.tbl_name;
@@ -228,46 +238,45 @@ async function getDatabaseIndexMap(db, dbType, schemaName, tableNames, introspec
 	}
 	return toDatabaseIndexMap([...indexMetadata.values()]);
 }
-async function getDatabaseColumnBounds(db, dbType, schemaName) {
-	if (dbType !== "mysql" && dbType !== "mssql") return /* @__PURE__ */ new Map();
+async function getDatabaseColumnBounds(db, target) {
 	let rows;
-	if (dbType === "mysql") rows = (await sql`
+	switch (target.type) {
+		case "postgres":
+		case "sqlite": return /* @__PURE__ */ new Map();
+		case "mysql":
+			rows = (await sql`
 				SELECT
 					table_name AS tableName,
 					column_name AS columnName,
-					data_type AS dataType,
-					character_maximum_length AS characterMaximumLength
+					character_octet_length AS maxIndexBytes
 				FROM information_schema.columns
 				WHERE table_schema = DATABASE()
 			`.execute(db)).rows;
-	else rows = (await sql`
+			break;
+		case "mssql":
+			rows = (await sql`
 				SELECT
 					tables.name AS "tableName",
 					columns.name AS "columnName",
-					types.name AS "dataType",
-					columns.max_length AS "maxLength"
+					columns.max_length AS "maxIndexBytes"
 				FROM sys.columns AS columns
 				INNER JOIN sys.tables AS tables
 					ON tables.object_id = columns.object_id
 				INNER JOIN sys.schemas AS table_schemas
 					ON table_schemas.schema_id = tables.schema_id
-				INNER JOIN sys.types AS types
-					ON types.user_type_id = columns.user_type_id
-				WHERE table_schemas.name = ${schemaName}
+				WHERE table_schemas.name = ${target.schema}
 			`.execute(db)).rows;
-	return new Map(rows.flatMap((row) => {
+			break;
+	}
+	const bounds = /* @__PURE__ */ new Map();
+	for (const row of rows) {
 		const table = row.tableName ?? row.TABLE_NAME;
 		const column = row.columnName ?? row.COLUMN_NAME;
-		const dataType = (row.dataType ?? row.DATA_TYPE)?.toLowerCase();
-		if (!table || !column || !dataType) return [];
-		if (dbType === "mysql") {
-			const characterLength = row.characterMaximumLength ?? row.CHARACTER_MAXIMUM_LENGTH;
-			const maxIndexBytes = characterLength === null || characterLength === void 0 ? null : Number(characterLength) * 4;
-			return [[createDatabaseColumnKey(table, column), { maxIndexBytes }]];
-		}
-		const maxLength = Number(row.maxLength ?? -1);
-		return [[createDatabaseColumnKey(table, column), { maxIndexBytes: maxLength < 0 ? null : maxLength }]];
-	}));
+		if (!table || !column) continue;
+		const maxIndexBytes = Number(row.maxIndexBytes ?? row.MAX_INDEX_BYTES ?? -1);
+		bounds.set(createDatabaseColumnKey(table, column), { maxIndexBytes: maxIndexBytes < 0 ? null : maxIndexBytes });
+	}
+	return bounds;
 }
 function assertExistingTableIndexFits({ columnBounds, dbType, existingColumns, fields, indexes, index, table }) {
 	const byteBudget = dbType === "mysql" ? 3072 : 1700;
@@ -341,7 +350,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		if (throwOnUnsafe) throw new UnsafeMigrationError(message);
 		unsafeChanges.push(message);
 	};
-	let { kysely: db, databaseType: dbType, introspectIndexes } = await createKyselyAdapter(config);
+	let { kysely: db, databaseType: dbType, introspectIndexes, schemaName } = await createKyselyAdapter(config);
 	if (!dbType) {
 		logger.warn("Could not determine database type, defaulting to sqlite. Please provide a type in the database options to avoid this.");
 		dbType = "sqlite";
@@ -350,39 +359,50 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		logger.error("Only kysely adapter is supported for migrations. You can use `generate` command to generate the schema, if you're using a different adapter.");
 		process.exit(1);
 	}
-	let currentSchema = dbType === "mssql" ? await getMssqlSchema(db) : "public";
-	if (dbType === "postgres") {
-		currentSchema = await getPostgresSchema(db);
-		logger.debug(`PostgreSQL migration: Using schema '${currentSchema}' (from search_path)`);
-		try {
-			const schemaCheck = await sql`
-				SELECT schema_name
-				FROM information_schema.schemata
-				WHERE schema_name = ${currentSchema}
-			`.execute(db);
-			if (!(schemaCheck.rows[0]?.schema_name ?? schemaCheck.rows[0]?.schemaName)) logger.warn(`Schema '${currentSchema}' does not exist. Tables will be inspected from available schemas. Consider creating the schema first or checking your database configuration.`);
-		} catch (error) {
-			logger.debug(`Could not verify schema existence: ${error instanceof Error ? error.message : String(error)}`);
-		}
-	} else if (dbType === "mssql") logger.debug(`SQL Server migration: Using schema '${currentSchema}' (from the current user's default schema)`);
 	const allTableMetadata = await db.introspection.getTables();
-	const databaseIndexMap = await getDatabaseIndexMap(db, dbType, currentSchema, allTableMetadata.map((table) => table.name), introspectIndexes);
-	const databaseColumnBounds = await getDatabaseColumnBounds(db, dbType, currentSchema);
+	let target;
 	let tableMetadata = allTableMetadata;
-	if (dbType === "postgres") try {
-		const tablesInSchema = await sql`
-				SELECT table_name
-				FROM information_schema.tables
-				WHERE table_schema = ${currentSchema}
-				AND table_type = 'BASE TABLE'
-			`.execute(db);
-		const tableNamesInSchema = new Set(tablesInSchema.rows.map((row) => row.table_name ?? row.tableName));
-		tableMetadata = allTableMetadata.filter((table) => table.schema === currentSchema && tableNamesInSchema.has(table.name));
-		logger.debug(`Found ${tableMetadata.length} table(s) in schema '${currentSchema}': ${tableMetadata.map((t) => t.name).join(", ") || "(none)"}`);
-	} catch (error) {
-		logger.warn(`Could not filter tables by schema. Using all discovered tables. Error: ${error instanceof Error ? error.message : String(error)}`);
+	switch (dbType) {
+		case "postgres": {
+			const schema = schemaName ?? await getPostgresSchema(db);
+			target = {
+				type: "postgres",
+				schema
+			};
+			logger.debug(`PostgreSQL migration: Using schema '${schema}' (${schemaName ? "from database.schemaName" : "from search_path"})`);
+			try {
+				if (!(await db.introspection.getSchemas()).some(({ name }) => name === schema)) if (schemaName) logger.debug(`Schema '${schema}' does not exist yet. The migration creates it before creating tables.`);
+				else logger.warn(`Schema '${schema}' does not exist. Create it before running migrations or check your database configuration.`);
+			} catch (error) {
+				logger.debug(`Could not verify schema existence: ${error instanceof Error ? error.message : String(error)}`);
+			}
+			/**
+			* Kysely 0.28 does not expose `isForeign`, while 0.29 adds foreign table metadata.
+			* @see https://github.com/kysely-org/kysely/pull/1494
+			*/
+			tableMetadata = allTableMetadata.filter((table) => table.schema === schema && !table.isView && !("isForeign" in table && table.isForeign));
+			logger.debug(`Found ${tableMetadata.length} table(s) in schema '${schema}': ${tableMetadata.map((table) => table.name).join(", ") || "(none)"}`);
+			break;
+		}
+		case "mssql": {
+			const schema = await getMssqlSchema(db);
+			target = {
+				type: "mssql",
+				schema
+			};
+			logger.debug(`SQL Server migration: Using schema '${schema}' (from the current user's default schema)`);
+			tableMetadata = allTableMetadata.filter((table) => table.schema === schema);
+			break;
+		}
+		case "mysql":
+			target = { type: "mysql" };
+			break;
+		case "sqlite":
+			target = { type: "sqlite" };
+			break;
 	}
-	else if (dbType === "mssql") tableMetadata = allTableMetadata.filter((table) => table.schema === currentSchema);
+	const databaseIndexMap = await getDatabaseIndexMap(db, target, allTableMetadata.map((table) => table.name), introspectIndexes);
+	const databaseColumnBounds = await getDatabaseColumnBounds(db, target);
 	const schemaProblems = diffSchema(toPhysicalSchema(db, betterAuthSchema), toIntrospectedTables(tableMetadata)).filter((finding) => finding.kind === "unexpected-required-column").map((finding) => formatSchemaFinding(finding, "database"));
 	const toBeCreated = [];
 	const toBeAdded = [];
@@ -464,6 +484,7 @@ async function getMigrations(config, { throwOnUnsafe = true } = {}) {
 		});
 	}
 	const migrations = [];
+	if (schemaName && toBeCreated.length > 0) migrations.push(db.schema.createSchema(schemaName).ifNotExists());
 	const useUUIDs = config.advanced?.database?.generateId === "uuid";
 	const useNumberId = config.advanced?.database?.generateId === "serial";
 	function getType(field, fieldName, tableIndexStringLength) {

package/dist/oauth2/index.d.mts

@@ -1,5 +1,5 @@
 import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "./state.mjs";
-import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount } from "./link-account.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
 export * from "@better-auth/core/oauth2";
-export { GenerateStateOptions, applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };
+export { GenerateStateOptions, applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, linkOAuthAccount, parseState, setTokenUtil };

package/dist/oauth2/index.mjs

@@ -1,5 +1,5 @@
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
-import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount } from "./link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./state.mjs";
 export * from "@better-auth/core/oauth2";
-export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };
+export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, linkOAuthAccount, parseState, setTokenUtil };

package/dist/oauth2/link-account.d.mts

@@ -2,9 +2,49 @@ import { Account, User } from "../types/models.mjs";
 import { GenericEndpointContext, UserProvisioningSource } from "@better-auth/core";
 
 //#region src/oauth2/link-account.d.ts
+type OAuthAccountData = Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+/**
+ * Provider profile a freshly linked account may copy onto the local user.
+ * `email` and `emailVerified` are identity anchors and are stripped before
+ * the remaining fields are written. Provider identity is resolved separately
+ * from the raw profile through the provider's account-key contract.
+ */
+type LinkedProviderProfile = {
+  name?: string | undefined;
+  email?: string | null | undefined;
+  emailVerified?: boolean | undefined;
+  image?: string | null | undefined;
+};
+interface LinkOAuthAccountOptions {
+  link: {
+    userId: string;
+    email: string;
+  };
+  userInfo: LinkedProviderProfile;
+  account: OAuthAccountData;
+  profile: Record<string, unknown>;
+  scopes?: string[] | undefined;
+}
+interface LinkOAuthAccountFailure {
+  linked: false;
+  error: {
+    code: string;
+    message?: string | undefined;
+  };
+}
+type LinkOAuthAccountResult = {
+  linked: true;
+} | LinkOAuthAccountFailure;
+declare function linkOAuthAccount(c: GenericEndpointContext, {
+  link,
+  userInfo,
+  account,
+  profile,
+  scopes
+}: LinkOAuthAccountOptions): Promise<LinkOAuthAccountResult>;
 declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
   userInfo: Omit<User, "createdAt" | "updatedAt">;
-  account: Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+  account: OAuthAccountData;
   callbackURL?: string | undefined;
   disableSignUp?: boolean | undefined;
   overrideUserInfo?: boolean | undefined;
@@ -67,18 +107,6 @@ declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
     password?: string | null | undefined;
   } | null;
 }>;
-/**
- * Provider profile a freshly linked account may copy onto the local user.
- * `email` and `emailVerified` are identity anchors and are stripped before
- * the remaining fields are written. Provider identity is resolved separately
- * from the raw profile through the provider's account-key contract.
- */
-type LinkedProviderProfile = {
-  name?: string | undefined;
-  email?: string | null | undefined;
-  emailVerified?: boolean | undefined;
-  image?: string | null | undefined;
-};
 /**
  * Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
  * copy the freshly linked provider's profile onto the local user, matching the
@@ -93,4 +121,4 @@ type LinkedProviderProfile = {
  */
 declare function applyUpdateUserInfoOnLink(c: GenericEndpointContext, userId: string, userInfo: LinkedProviderProfile): Promise<User | undefined>;
 //#endregion
-export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount };

package/dist/oauth2/link-account.mjs

@@ -8,7 +8,67 @@ import { createEmailVerificationToken } from "../api/routes/email-verification.m
 import { queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
 import { isDevelopment } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
+import { mergeScopes } from "@better-auth/core/oauth2";
 //#region src/oauth2/link-account.ts
+function linkOAuthAccountFailure(code, message) {
+	return {
+		linked: false,
+		error: {
+			code,
+			message
+		}
+	};
+}
+async function linkOAuthAccount(c, { link, userInfo, account, profile, scopes }) {
+	try {
+		await assertValidUserInfo(c, {
+			user: {
+				...userInfo,
+				id: link.userId,
+				email: userInfo.email ?? void 0
+			},
+			source: {
+				action: "link-account",
+				method: "oauth",
+				oauth: {
+					providerId: account.providerId,
+					profile
+				}
+			}
+		});
+	} catch (error) {
+		if (!isAPIError(error) || !error.body?.code) throw error;
+		return linkOAuthAccountFailure(error.body.code, error.body.message);
+	}
+	if (!c.context.trustedProviders.includes(account.providerId) && !userInfo.emailVerified || c.context.options.account?.accountLinking?.enabled === false) {
+		c.context.logger.error("Unable to link account - untrusted provider");
+		return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
+	}
+	if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.EMAIL_DOES_NOT_MATCH);
+	const existingAccount = await c.context.internalAdapter.findAccountByKey(account);
+	if (existingAccount) {
+		if (existingAccount.userId.toString() !== link.userId.toString()) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.ACCOUNT_ALREADY_LINKED_TO_DIFFERENT_USER);
+		const mergedScope = mergeScopes(existingAccount.scope, scopes);
+		const updateData = Object.fromEntries(Object.entries({
+			providerId: account.providerId,
+			accessToken: await setTokenUtil(account.accessToken, c.context),
+			refreshToken: await setTokenUtil(account.refreshToken, c.context),
+			idToken: account.idToken,
+			accessTokenExpiresAt: account.accessTokenExpiresAt,
+			refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+			scope: mergedScope || void 0
+		}).filter(([_, value]) => value !== void 0));
+		await c.context.internalAdapter.updateAccount(existingAccount.id, updateData);
+	} else if (!await c.context.internalAdapter.createAccount({
+		userId: link.userId,
+		...account,
+		accessToken: await setTokenUtil(account.accessToken, c.context),
+		refreshToken: await setTokenUtil(account.refreshToken, c.context),
+		scope: scopes?.join(",") ?? account.scope
+	})) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
+	await applyUpdateUserInfoOnLink(c, link.userId, userInfo);
+	return { linked: true };
+}
 async function handleOAuthUserInfo(c, opts) {
 	const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
 	const source = opts.source ?? {
@@ -326,4 +386,4 @@ async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
 	}
 }
 //#endregion
-export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount };

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.4";
+var version = "1.7.6";
 //#endregion
 export { version };

package/dist/plugins/admin/admin.d.mts

@@ -297,13 +297,13 @@ declare const admin: <O extends AdminOptions>(options?: O | undefined) => {
         filterField: _$zod.ZodOptional<_$zod.ZodString>;
         filterValue: _$zod.ZodOptional<_$zod.ZodUnion<[_$zod.ZodUnion<[_$zod.ZodUnion<[_$zod.ZodUnion<[_$zod.ZodString, _$zod.ZodNumber]>, _$zod.ZodBoolean]>, _$zod.ZodArray<_$zod.ZodString>]>, _$zod.ZodArray<_$zod.ZodNumber>]>>;
         filterOperator: _$zod.ZodOptional<_$zod.ZodEnum<{
+          in: "in";
+          lte: "lte";
           eq: "eq";
           ne: "ne";
+          lt: "lt";
           gt: "gt";
           gte: "gte";
-          lt: "lt";
-          lte: "lte";
-          in: "in";
           not_in: "not_in";
           contains: "contains";
           starts_with: "starts_with";

package/dist/plugins/admin/admin.mjs

@@ -42,8 +42,10 @@ const admin = (options) => {
 							});
 							return;
 						}
+						const bannedUserMessage = opts.bannedUserMessage;
+						const message = typeof bannedUserMessage === "function" ? await bannedUserMessage(user) : bannedUserMessage;
 						throw APIError.from("FORBIDDEN", {
-							message: opts.bannedUserMessage,
+							message,
 							code: "BANNED_USER"
 						});
 					}

package/dist/plugins/admin/routes.mjs

@@ -2,6 +2,7 @@ import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermission } from "./has-permission.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -190,6 +191,7 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 	}
 	const email = ctx.body.email.toLowerCase();
 	if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
+	if (ctx.body.password) assertPasswordNotTooLong(ctx, ctx.body.password);
 	if (await ctx.context.internalAdapter.findUserByEmail(email)) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);
 	const user = await ctx.context.internalAdapter.createUser({
 		...userData,
@@ -823,16 +825,8 @@ const setUserPassword = (opts) => createAuthEndpoint("/admin/set-user-password",
 		permissions: { user: ["set-password"] }
 	})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD);
 	const { newPassword, userId } = ctx.body;
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (newPassword.length < minPasswordLength) {
-		ctx.context.logger.warn("Password is too short");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	}
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (newPassword.length > maxPasswordLength) {
-		ctx.context.logger.warn("Password is too long");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-	}
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	if (!user) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const hashedPassword = await ctx.context.password.hash(newPassword);

package/dist/plugins/admin/types.d.mts

@@ -2,6 +2,7 @@ import { Session, User } from "../../types/models.mjs";
 import { InferOptionSchema } from "../../types/plugins.mjs";
 import { AccessControl, Role } from "../access/types.mjs";
 import { AdminSchema } from "./schema.mjs";
+import { Awaitable } from "@better-auth/core";
 
 //#region src/plugins/admin/types.d.ts
 interface UserWithRole extends User {
@@ -70,8 +71,10 @@ interface AdminOptions {
    * Message to show when a user is banned
    *
    * By default, the message is "You have been banned from this application"
+   *
+   * Can also be a function that receives the banned user and returns a message.
    */
-  bannedUserMessage?: string | undefined;
+  bannedUserMessage?: string | ((user: UserWithRole & Record<string, unknown>) => Awaitable<string>) | undefined;
   /**
    * Whether to allow impersonating other admins.
    *

package/dist/plugins/captcha/constants.d.mts

@@ -4,6 +4,7 @@ declare const Providers: {
   readonly GOOGLE_RECAPTCHA: "google-recaptcha";
   readonly HCAPTCHA: "hcaptcha";
   readonly CAPTCHAFOX: "captchafox";
+  readonly VERCEL_BOTID: "vercel-botid";
 };
 //#endregion
 export { Providers };

package/dist/plugins/captcha/constants.mjs

@@ -15,7 +15,8 @@ const Providers = {
 	CLOUDFLARE_TURNSTILE: "cloudflare-turnstile",
 	GOOGLE_RECAPTCHA: "google-recaptcha",
 	HCAPTCHA: "hcaptcha",
-	CAPTCHAFOX: "captchafox"
+	CAPTCHAFOX: "captchafox",
+	VERCEL_BOTID: "vercel-botid"
 };
 const siteVerifyMap = {
 	[Providers.CLOUDFLARE_TURNSTILE]: "https://challenges.cloudflare.com/turnstile/v0/siteverify",

package/dist/plugins/captcha/index.d.mts

@@ -1,4 +1,4 @@
-import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./types.mjs";
+import { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions } from "./types.mjs";
 import * as _$_better_auth_core0 from "@better-auth/core";
 import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
 
@@ -24,4 +24,4 @@ declare const captcha: (options: CaptchaOptions) => {
   options: CaptchaOptions;
 };
 //#endregion
-export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, captcha };
+export { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions, captcha };

package/dist/plugins/captcha/index.mjs

@@ -7,6 +7,7 @@ import { captchaFox } from "./verify-handlers/captchafox.mjs";
 import { cloudflareTurnstile } from "./verify-handlers/cloudflare-turnstile.mjs";
 import { googleRecaptcha } from "./verify-handlers/google-recaptcha.mjs";
 import { hCaptcha } from "./verify-handlers/h-captcha.mjs";
+import { vercelBotId } from "./verify-handlers/vercel-botid.mjs";
 import { getIP } from "@better-auth/core/utils/ip";
 //#region src/plugins/captcha/index.ts
 const normalizeEndpointPath = (pathname, basePath) => {
@@ -26,6 +27,11 @@ const captcha = (options) => ({
 			const basePath = ctx.options.basePath ?? "/api/auth";
 			const pathname = normalizeEndpointPath(url.pathname, basePath);
 			if (!endpoints.some((endpoint) => endpoint.includes("*") ? wildcardMatch(endpoint)(pathname) : endpoint === pathname)) return;
+			if (options.provider === Providers.VERCEL_BOTID) return await vercelBotId({
+				request,
+				checkBotId: options.checkBotId,
+				validateRequest: options.validateRequest
+			});
 			if (!options.secretKey) throw new Error(INTERNAL_ERROR_CODES.MISSING_SECRET_KEY.message);
 			const captchaResponse = request.headers.get("x-captcha-response");
 			const remoteUserIP = getIP(request, ctx.options) ?? void 0;
@@ -42,6 +48,7 @@ const captcha = (options) => ({
 			};
 			if (options.provider === Providers.CLOUDFLARE_TURNSTILE) return await cloudflareTurnstile({
 				...handlerParams,
+				logger: ctx.logger,
 				expectedAction: options.expectedAction,
 				allowedHostnames: options.allowedHostnames
 			});