better-auth 1.7.4 → 1.7.6

package/dist/plugins/captcha/types.d.mts

@@ -47,6 +47,48 @@ interface CaptchaFoxOptions extends BaseCaptchaOptions {
   provider: typeof Providers.CAPTCHAFOX;
   siteKey?: string | undefined;
 }
-type CaptchaOptions = GoogleRecaptchaOptions | CloudflareTurnstileOptions | HCaptchaOptions | CaptchaFoxOptions;
+/**
+ * BotID verdict fields available to custom request validation.
+ *
+ * @see https://vercel.com/docs/botid/verified-bots
+ */
+type BotIdVerification = {
+  isBot: boolean;
+  isVerifiedBot?: boolean | undefined;
+  verifiedBotName?: string | undefined;
+  verifiedBotCategory?: string | undefined;
+};
+type ValidateRequestContext = {
+  request: Request;
+  verification: BotIdVerification;
+};
+/**
+ * Protect auth requests with Vercel BotID. The browser must also protect the
+ * same request paths and methods with BotID's client SDK.
+ *
+ * @see https://vercel.com/docs/botid/get-started
+ */
+interface VercelBotIdOptions {
+  provider: typeof Providers.VERCEL_BOTID;
+  /**
+   * Auth paths to verify, without the Better Auth base path.
+   *
+   * @default ["/sign-up/email", "/sign-in/email", "/request-password-reset"]
+   */
+  endpoints?: string[] | undefined;
+  /**
+   * Vercel's server-side check for the current request. Pass `checkBotId` from
+   * `botid/server`, or wrap it to supply SDK options.
+   */
+  checkBotId: () => Promise<BotIdVerification>;
+  /**
+   * Override the default `isBot === false` decision. Return `true` to allow
+   * the request, including a verified bot you trust.
+   *
+   * @see https://vercel.com/docs/botid/verified-bots
+   */
+  validateRequest?: (ctx: ValidateRequestContext) => boolean | Promise<boolean>;
+}
+type CaptchaOptions = GoogleRecaptchaOptions | CloudflareTurnstileOptions | HCaptchaOptions | CaptchaFoxOptions | VercelBotIdOptions;
 //#endregion
-export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider };
+export { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions };

package/dist/plugins/captcha/utils.mjs

@@ -5,5 +5,15 @@ const encodeToURLParams = (obj) => {
 	for (const [key, value] of Object.entries(obj)) if (value !== void 0 && value !== null) params.append(key, String(value));
 	return params.toString();
 };
+/**
+* Rejects after `timeoutMs` without cancelling the underlying promise.
+*/
+const withTimeout = (promise, timeoutMs) => {
+	let timer;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error("Operation timed out")), timeoutMs);
+	});
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+};
 //#endregion
-export { encodeToURLParams };
+export { encodeToURLParams, withTimeout };

package/dist/plugins/captcha/verify-handlers/cloudflare-turnstile.mjs

@@ -3,7 +3,7 @@ import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
 import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
 import { betterFetch } from "@better-fetch/fetch";
 //#region src/plugins/captcha/verify-handlers/cloudflare-turnstile.ts
-const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey, remoteIP, expectedAction, allowedHostnames }) => {
+const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey, logger, remoteIP, expectedAction, allowedHostnames }) => {
 	const response = await betterFetch(siteVerifyURL, {
 		method: "POST",
 		timeout: CAPTCHA_VERIFY_TIMEOUT_MS,
@@ -15,14 +15,33 @@ const cloudflareTurnstile = async ({ siteVerifyURL, captchaResponse, secretKey,
 		})
 	});
 	if (!response.data || response.error) throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message);
-	const verificationFailed = () => middlewareResponse({
-		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
-		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
-		status: 403
+	const verificationFailed = (details) => {
+		logger.warn("Cloudflare Turnstile verification failed", {
+			provider: "cloudflare-turnstile",
+			...details
+		});
+		return middlewareResponse({
+			message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+			code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+			status: 403
+		});
+	};
+	if (!response.data.success) return verificationFailed({
+		reason: "siteverify_rejected",
+		errorCodes: response.data["error-codes"] ?? [],
+		...response.data.hostname && { hostname: response.data.hostname },
+		...response.data.action && { action: response.data.action }
+	});
+	if (expectedAction && response.data.action !== expectedAction) return verificationFailed({
+		reason: "action_mismatch",
+		expectedAction,
+		actualAction: response.data.action
+	});
+	if (allowedHostnames && allowedHostnames.length > 0 && !(response.data.hostname && allowedHostnames.includes(response.data.hostname))) return verificationFailed({
+		reason: "hostname_mismatch",
+		allowedHostnames,
+		actualHostname: response.data.hostname
 	});
-	if (!response.data.success) return verificationFailed();
-	if (expectedAction && response.data.action !== expectedAction) return verificationFailed();
-	if (allowedHostnames && allowedHostnames.length > 0 && !(response.data.hostname && allowedHostnames.includes(response.data.hostname))) return verificationFailed();
 };
 //#endregion
 export { cloudflareTurnstile };

package/dist/plugins/captcha/verify-handlers/vercel-botid.mjs

@@ -0,0 +1,27 @@
+import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
+import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
+import { withTimeout } from "../utils.mjs";
+//#region src/plugins/captcha/verify-handlers/vercel-botid.ts
+const vercelBotId = async ({ request, checkBotId, validateRequest }) => {
+	let isValid;
+	try {
+		isValid = await withTimeout((async () => {
+			const verification = await checkBotId();
+			return validateRequest ? validateRequest({
+				request,
+				verification
+			}) : verification.isBot === false;
+		})(), CAPTCHA_VERIFY_TIMEOUT_MS);
+	} catch (error) {
+		throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message, { cause: error });
+	}
+	if (isValid) return void 0;
+	return middlewareResponse({
+		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+		status: 403
+	});
+};
+//#endregion
+export { vercelBotId };

package/dist/plugins/email-otp/routes.mjs

@@ -6,6 +6,7 @@ import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
 import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
 import { splitAtLastColon, toOTPIdentifier } from "./utils.mjs";
@@ -581,10 +582,8 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	} }
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (ctx.body.password.length < minPasswordLength) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (ctx.body.password.length > maxPasswordLength) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	assertPasswordNotTooShort(ctx, ctx.body.password);
+	assertPasswordNotTooLong(ctx, ctx.body.password);
 	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("forget-password", email), ctx.body.otp);
 	const user = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);

package/dist/plugins/index.d.mts

@@ -10,7 +10,7 @@ import { admin } from "./admin/admin.mjs";
 import { AnonymousOptions, AnonymousSession, UserWithAnonymous } from "./anonymous/types.mjs";
 import { anonymous } from "./anonymous/index.mjs";
 import { BearerOptions, bearer } from "./bearer/index.mjs";
-import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./captcha/types.mjs";
+import { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions } from "./captcha/types.mjs";
 import { captcha } from "./captcha/index.mjs";
 import { CustomSessionPluginOptions, customSession } from "./custom-session/index.mjs";
 import { TimeString, ms, sec } from "../utils/time.mjs";
@@ -66,4 +66,4 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, ValidateRequestContext, VercelBotIdOptions, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/oauth-proxy/index.mjs

@@ -7,7 +7,7 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { redirectOnError } from "../../oauth2/errors.mjs";
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
-import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { setOAuthState } from "../../api/state/oauth.mjs";
 import { parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
@@ -37,6 +37,7 @@ const passthroughPayloadSchema = z.looseObject({
 		updatedAt: true
 	}).shape),
 	profile: z.record(z.string(), z.unknown()).optional(),
+	scopes: z.array(z.string()).optional(),
 	state: z.string().min(1),
 	callbackURL: z.string().min(1),
 	newUserURL: z.string().optional(),
@@ -107,7 +108,19 @@ const oAuthProxy = (opts) => {
 			ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
 			throw redirectOnError(ctx, errorURL, "payload_expired");
 		}
-		if (!await restoreOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
+		const stateData = await restoreOAuthProxyState(ctx, payload.state);
+		if (!stateData) throw redirectOnError(ctx, errorURL, "state_mismatch");
+		if (stateData.link) {
+			const linkResult = await linkOAuthAccount(ctx, {
+				link: stateData.link,
+				userInfo: payload.userInfo,
+				account: payload.account,
+				profile: payload.profile ?? {},
+				scopes: payload.scopes ?? payload.account.scope?.split(",")
+			});
+			if (!linkResult.linked) throw redirectOnError(ctx, errorURL, linkResult.error.code, linkResult.error.message);
+			throw ctx.redirect(payload.callbackURL);
+		}
 		let result;
 		try {
 			result = await handleOAuthUserInfo(ctx, {
@@ -185,7 +198,7 @@ const oAuthProxy = (opts) => {
 		hooks: {
 			before: [{
 				matcher(context) {
-					return !!context.path?.startsWith("/sign-in/social");
+					return !!context.path?.startsWith("/sign-in/social") || context.path === "/link-social";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					if (checkSkipProxy(ctx, opts)) return;
@@ -307,6 +320,7 @@ const oAuthProxy = (opts) => {
 							emailVerified: userInfo.emailVerified
 						},
 						profile: providerProfile,
+						scopes: tokens.scopes,
 						account: {
 							...accountKey,
 							accessToken: tokens.accessToken,
@@ -333,14 +347,14 @@ const oAuthProxy = (opts) => {
 			}],
 			after: [{
 				matcher(context) {
-					return !!context.path?.startsWith("/sign-in/social");
+					return !!context.path?.startsWith("/sign-in/social") || context.path === "/link-social";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					if (checkSkipProxy(ctx, opts)) return;
 					const signInResponse = ctx.context.returned;
 					if (!signInResponse || typeof signInResponse !== "object" || !("url" in signInResponse)) return;
 					const { url: providerURL } = signInResponse;
-					if (typeof providerURL !== "string") return;
+					if (typeof providerURL !== "string" || providerURL.length === 0) return;
 					const oauthURL = new URL(providerURL);
 					const originalState = oauthURL.searchParams.get("state");
 					if (!originalState) return;

package/dist/plugins/organization/routes/crud-members.d.mts

@@ -736,13 +736,13 @@ declare const listMembers: <O extends OrganizationOptions>(options: O) => _$bett
     filterField: z.ZodOptional<z.ZodString>;
     filterValue: z.ZodOptional<z.ZodUnion<[z.ZodUnion<[z.ZodUnion<[z.ZodUnion<[z.ZodString, z.ZodNumber]>, z.ZodBoolean]>, z.ZodArray<z.ZodString>]>, z.ZodArray<z.ZodNumber>]>>;
     filterOperator: z.ZodOptional<z.ZodEnum<{
+      in: "in";
+      lte: "lte";
       eq: "eq";
       ne: "ne";
+      lt: "lt";
       gt: "gt";
       gte: "gte";
-      lt: "lt";
-      lte: "lte";
-      in: "in";
       not_in: "not_in";
       contains: "contains";
       starts_with: "starts_with";

package/dist/plugins/organization/schema.d.mts

@@ -244,10 +244,10 @@ type OrganizationSchema<O extends OrganizationOptions> = (O["dynamicAccessContro
 };
 declare const roleSchema: z.ZodString;
 declare const invitationStatus: z.ZodDefault<z.ZodEnum<{
-  canceled: "canceled";
   pending: "pending";
   accepted: "accepted";
   rejected: "rejected";
+  canceled: "canceled";
 }>>;
 declare const organizationSchema: z.ZodObject<{
   id: z.ZodDefault<z.ZodString>;
@@ -270,10 +270,10 @@ declare const invitationSchema: z.ZodObject<{
   email: z.ZodString;
   role: z.ZodString;
   status: z.ZodDefault<z.ZodEnum<{
-    canceled: "canceled";
     pending: "pending";
     accepted: "accepted";
     rejected: "rejected";
+    canceled: "canceled";
   }>>;
   teamId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
   inviterId: z.ZodString;

package/dist/plugins/phone-number/routes.mjs

@@ -4,6 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -54,6 +55,7 @@ const signInPhoneNumber = (opts) => createAuthEndpoint("/sign-in/phone-number",
 	if (opts.phoneNumberValidator) {
 		if (!await opts.phoneNumberValidator(ctx.body.phoneNumber)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_PHONE_NUMBER);
 	}
+	assertPasswordNotTooLong(ctx, password);
 	const user = await ctx.context.adapter.findOne({
 		model: "user",
 		where: [{
@@ -466,10 +468,8 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		}]
 	});
 	if (!user) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.UNEXPECTED_ERROR);
-	const minLength = ctx.context.password.config.minPasswordLength;
-	const maxLength = ctx.context.password.config.maxPasswordLength;
-	if (ctx.body.newPassword.length < minLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	if (ctx.body.newPassword.length > maxLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
+	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
 	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
 	if (!await ctx.context.internalAdapter.findCredentialAccount(user.id)) await ctx.context.internalAdapter.createAccount({
 		userId: user.id,

package/dist/plugins/username/index.d.mts

@@ -266,14 +266,14 @@ declare const usernameImpl: <IncludeDisplayUsername extends boolean>(options: Us
           unique: true;
           returned: true;
           transform: {
-            input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | Record<string, unknown> | unknown[] | null | undefined;
+            input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | unknown[] | Record<string, unknown> | null | undefined;
           };
         };
         displayUsername: {
           type: "string";
           required: false;
           transform: {
-            input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | Record<string, unknown> | unknown[] | null | undefined;
+            input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | unknown[] | Record<string, unknown> | null | undefined;
           };
         };
       }, "username"> : {
@@ -284,14 +284,14 @@ declare const usernameImpl: <IncludeDisplayUsername extends boolean>(options: Us
           unique: true;
           returned: true;
           transform: {
-            input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | Record<string, unknown> | unknown[] | null | undefined;
+            input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | unknown[] | Record<string, unknown> | null | undefined;
           };
         };
         displayUsername: {
           type: "string";
           required: false;
           transform: {
-            input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | Record<string, unknown> | unknown[] | null | undefined;
+            input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | unknown[] | Record<string, unknown> | null | undefined;
           };
         };
       };

package/dist/plugins/username/index.mjs

@@ -2,6 +2,7 @@ import { mergeSchema, parseUserOutput } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { createEmailVerificationToken } from "../../api/routes/email-verification.mjs";
+import { assertPasswordNotTooLong } from "../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { USERNAME_ERROR_CODES } from "./error-codes.mjs";
 import { getSchema } from "./schema.mjs";
@@ -166,6 +167,7 @@ const usernameImpl = (options, includeDisplayUsername) => {
 					throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
 				}
 				if (!await (options?.usernameValidator || defaultUsernameValidator)(username)) throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.INVALID_USERNAME);
+				assertPasswordNotTooLong(ctx, ctx.body.password);
 				const user = await ctx.context.adapter.findOne({
 					model: "user",
 					where: [{

package/dist/plugins/username/schema.d.mts

@@ -14,14 +14,14 @@ declare const getSchema: <IncludeDisplayUsername extends boolean = true>(normali
         unique: true;
         returned: true;
         transform: {
-          input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | Record<string, unknown> | unknown[] | null | undefined;
+          input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | unknown[] | Record<string, unknown> | null | undefined;
         };
       };
       displayUsername: {
         type: "string";
         required: false;
         transform: {
-          input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | Record<string, unknown> | unknown[] | null | undefined;
+          input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | unknown[] | Record<string, unknown> | null | undefined;
         };
       };
     }, "username"> : {
@@ -32,14 +32,14 @@ declare const getSchema: <IncludeDisplayUsername extends boolean = true>(normali
         unique: true;
         returned: true;
         transform: {
-          input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | Record<string, unknown> | unknown[] | null | undefined;
+          input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | unknown[] | Record<string, unknown> | null | undefined;
         };
       };
       displayUsername: {
         type: "string";
         required: false;
         transform: {
-          input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | Record<string, unknown> | unknown[] | null | undefined;
+          input(value: _$_better_auth_core_db0.DBPrimitive): string | number | boolean | Date | unknown[] | Record<string, unknown> | null | undefined;
         };
       };
     };

package/dist/test-utils/http-test-instance.d.mts

@@ -88,17 +88,17 @@ declare function getHttpTestInstance<O extends Partial<BetterAuthOptions>, C ext
           onResponse: ((context: _$_better_fetch_fetch0.ResponseContext) => Promise<Response | void | _$_better_fetch_fetch0.ResponseContext> | Response | _$_better_fetch_fetch0.ResponseContext | void) | undefined;
         };
       })[];
-      priority?: RequestPriority | undefined;
       cache?: RequestCache | undefined;
       credentials?: RequestCredentials;
       integrity?: string | undefined;
       keepalive?: boolean | undefined;
       method: string;
       mode?: RequestMode | undefined;
+      priority?: RequestPriority | undefined;
       redirect?: RequestRedirect | undefined;
       referrer?: string | undefined;
       referrerPolicy?: ReferrerPolicy | undefined;
-      signal?: (AbortSignal | null) | undefined;
+      signal?: AbortSignal | null;
       window?: null | undefined;
       onRetry?: ((response: _$_better_fetch_fetch0.ResponseContext) => Promise<void> | void) | undefined;
       hookOptions?: {

package/dist/utils/password.mjs

@@ -1,6 +1,19 @@
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 //#region src/utils/password.ts
+function assertPasswordNotTooShort(ctx, password) {
+	if (password.length < ctx.context.password.config.minPasswordLength) {
+		ctx.context.logger.warn("Password is too short");
+		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
+	}
+}
+function assertPasswordNotTooLong(ctx, password) {
+	if (password.length > ctx.context.password.config.maxPasswordLength) {
+		ctx.context.logger.warn("Password is too long");
+		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	}
+}
 async function validatePassword(ctx, data) {
+	assertPasswordNotTooLong(ctx, data.password);
 	const credentialAccount = await ctx.context.internalAdapter.findCredentialAccount(data.userId);
 	const currentPassword = credentialAccount?.password;
 	if (!credentialAccount || !currentPassword) return false;
@@ -10,9 +23,10 @@ async function validatePassword(ctx, data) {
 	});
 }
 async function checkPassword(userId, c) {
+	const password = c.body.password;
+	if (typeof password === "string") assertPasswordNotTooLong(c, password);
 	const credentialAccount = await c.context.internalAdapter.findCredentialAccount(userId);
 	const currentPassword = credentialAccount?.password;
-	const password = c.body.password;
 	if (!credentialAccount || !currentPassword || !password) {
 		if (password) await c.context.password.hash(password);
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
@@ -29,4 +43,4 @@ async function shouldRequirePassword(ctx, userId, allowPasswordless) {
 	return Boolean(credentialAccount?.password);
 }
 //#endregion
-export { checkPassword, shouldRequirePassword, validatePassword };
+export { assertPasswordNotTooLong, assertPasswordNotTooShort, checkPassword, shouldRequirePassword, validatePassword };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -464,7 +464,7 @@
   },
   "dependencies": {
     "@better-auth/utils": "0.4.2",
-    "@better-fetch/fetch": "1.3.1",
+    "@better-fetch/fetch": "1.3.2",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
     "better-call": "1.4.0",
@@ -473,13 +473,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.4",
-    "@better-auth/drizzle-adapter": "1.7.4",
-    "@better-auth/kysely-adapter": "1.7.4",
-    "@better-auth/memory-adapter": "1.7.4",
-    "@better-auth/mongo-adapter": "1.7.4",
-    "@better-auth/prisma-adapter": "1.7.4",
-    "@better-auth/telemetry": "1.7.4"
+    "@better-auth/core": "1.7.6",
+    "@better-auth/drizzle-adapter": "1.7.6",
+    "@better-auth/kysely-adapter": "1.7.6",
+    "@better-auth/memory-adapter": "1.7.6",
+    "@better-auth/mongo-adapter": "1.7.6",
+    "@better-auth/prisma-adapter": "1.7.6",
+    "@better-auth/telemetry": "1.7.6"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -494,6 +494,7 @@
     "@types/pg": "^8.20.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
+    "botid": "^1.5.10",
     "happy-dom": "^20.8.9",
     "msw": "^2.14.6",
     "next": "^16.3.4",
@@ -513,7 +514,6 @@
     "@sveltejs/kit": "^2.0.0",
     "@tanstack/react-start": "^1.0.0",
     "@tanstack/solid-start": "^1.0.0",
-    "better-sqlite3": "^12.0.0",
     "drizzle-kit": ">=0.31.4 || >=1.0.0-beta.1",
     "drizzle-orm": "^0.45.2 || >=1.0.0-rc.1 <2.0.0",
     "mongodb": "^6.0.0 || ^7.0.0",
@@ -580,9 +580,6 @@
     "prisma": {
       "optional": true
     },
-    "better-sqlite3": {
-      "optional": true
-    },
     "vitest": {
       "optional": true
     }