better-auth 1.7.5 → 1.7.6

package/dist/api/routes/callback.mjs

@@ -1,14 +1,12 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
-import { assertValidUserInfo } from "../../utils/validate-user-info.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
 import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
-import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
+import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "../../oauth2/state.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import { mergeScopes } from "@better-auth/core/oauth2";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -149,72 +147,26 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		c.context.logger.error("No callback URL found");
 		throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.NO_CALLBACK_URL);
 	}
+	const accountData = {
+		...accountKey,
+		...tokens,
+		scope: tokens.scopes?.join(",")
+	};
 	if (link) {
-		try {
-			await assertValidUserInfo(c, {
-				user: {
-					...userInfo,
-					id: link.userId,
-					email: userInfo.email ?? void 0
-				},
-				source: {
-					action: "link-account",
-					method: "oauth",
-					oauth: {
-						providerId: provider.id,
-						profile: providerProfile
-					}
-				}
-			});
-		} catch (e) {
-			if (isAPIError(e) && e.body?.code) throw redirectOnError(e.body.code, e.body.message);
-			throw e;
-		}
-		if (!c.context.trustedProviders.includes(provider.id) && !userInfo.emailVerified || c.context.options.account?.accountLinking?.enabled === false) {
-			c.context.logger.error("Unable to link account - untrusted provider");
-			return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
-		}
-		if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.EMAIL_DOES_NOT_MATCH);
-		const existingAccount = await c.context.internalAdapter.findAccountByKey(accountKey);
-		if (existingAccount) {
-			if (existingAccount.userId.toString() !== link.userId.toString()) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.ACCOUNT_ALREADY_LINKED_TO_DIFFERENT_USER);
-			const mergedScope = mergeScopes(existingAccount.scope, tokens.scopes);
-			const updateData = Object.fromEntries(Object.entries({
-				providerId: provider.id,
-				accessToken: await setTokenUtil(tokens.accessToken, c.context),
-				refreshToken: await setTokenUtil(tokens.refreshToken, c.context),
-				idToken: tokens.idToken,
-				accessTokenExpiresAt: tokens.accessTokenExpiresAt,
-				refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
-				scope: mergedScope || void 0
-			}).filter(([_, value]) => value !== void 0));
-			await c.context.internalAdapter.updateAccount(existingAccount.id, updateData);
-		} else if (!await c.context.internalAdapter.createAccount({
-			userId: link.userId,
-			...accountKey,
-			...tokens,
-			accessToken: await setTokenUtil(tokens.accessToken, c.context),
-			refreshToken: await setTokenUtil(tokens.refreshToken, c.context),
-			scope: tokens.scopes?.join(",")
-		})) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
-		await applyUpdateUserInfoOnLink(c, link.userId, userInfo);
-		let toRedirectTo;
-		try {
-			toRedirectTo = callbackURL.toString();
-		} catch {
-			toRedirectTo = callbackURL;
-		}
-		throw c.redirect(toRedirectTo);
+		const linkResult = await linkOAuthAccount(c, {
+			link,
+			userInfo,
+			account: accountData,
+			profile: providerProfile,
+			scopes: tokens.scopes
+		});
+		if (!linkResult.linked) return redirectOnError(linkResult.error.code, linkResult.error.message);
+		throw c.redirect(callbackURL);
 	}
 	if (!userInfo.email) {
 		c.context.logger.error(missingEmailLogMessage(provider.id));
 		return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_FOUND);
 	}
-	const accountData = {
-		...accountKey,
-		...tokens,
-		scope: tokens.scopes?.join(",")
-	};
 	let result;
 	try {
 		result = await handleOAuthUserInfo(c, {

package/dist/api/routes/password.mjs

@@ -1,7 +1,7 @@
 import { originCheck } from "../middlewares/origin-check.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { sensitiveSessionMiddleware } from "./session.mjs";
-import { validatePassword } from "../../utils/password.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort, validatePassword } from "../../utils/password.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -149,10 +149,8 @@ const resetPassword = createAuthEndpoint("/reset-password", {
 	const token = ctx.body.token || ctx.query?.token;
 	if (!token) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);
 	const { newPassword } = ctx.body;
-	const minLength = ctx.context.password?.config.minPasswordLength;
-	const maxLength = ctx.context.password?.config.maxPasswordLength;
-	if (newPassword.length < minLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	if (newPassword.length > maxLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
 	const id = `reset-password:${token}`;
 	const verification = await ctx.context.internalAdapter.consumeVerificationValue(id);
 	if (!verification) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);

package/dist/api/routes/sign-in.mjs

@@ -9,6 +9,7 @@ import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
+import { assertPasswordNotTooLong } from "../../utils/password.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -312,6 +313,7 @@ const signInEmail = () => createAuthEndpoint("/sign-in/email", {
 	}
 	const { email, password } = ctx.body;
 	if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
+	assertPasswordNotTooLong(ctx, password);
 	const userRecord = await ctx.context.internalAdapter.findUserByEmail(email.toLowerCase(), { includeAccounts: true });
 	const credentialAccount = userRecord?.accounts.find((account) => account.providerId === "credential" && account.accountId === userRecord.user.id);
 	if (!userRecord || !credentialAccount) {

package/dist/api/routes/sign-up.mjs

@@ -4,6 +4,7 @@ import { buildSyntheticUserOutput, parseUserInput, parseUserOutput } from "../..
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { runWithTransaction } from "@better-auth/core/context";
 import { isDevelopment } from "@better-auth/core/env";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -149,16 +150,8 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 		const { name, email, password, image, callbackURL: _callbackURL, rememberMe, ...rest } = body;
 		if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
 		if (!password || typeof password !== "string") throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
-		const minPasswordLength = ctx.context.password.config.minPasswordLength;
-		if (password.length < minPasswordLength) {
-			ctx.context.logger.warn("Password is too short");
-			throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-		}
-		const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-		if (password.length > maxPasswordLength) {
-			ctx.context.logger.warn("Password is too long");
-			throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-		}
+		assertPasswordNotTooShort(ctx, password);
+		assertPasswordNotTooLong(ctx, password);
 		const shouldReturnGenericDuplicateResponse = ctx.context.options.emailAndPassword.requireEmailVerification || ctx.context.options.emailAndPassword.autoSignIn === false;
 		const shouldSkipAutoSignIn = ctx.context.options.emailAndPassword.autoSignIn === false || shouldReturnGenericDuplicateResponse;
 		const additionalUserFields = parseUserInput(ctx.context.options, rest, "create");

package/dist/api/routes/update-user.mjs

@@ -4,6 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { deleteSessionCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -158,16 +159,9 @@ const changePassword = createAuthEndpoint("/change-password", {
 }, async (ctx) => {
 	const { newPassword, currentPassword, revokeOtherSessions } = ctx.body;
 	const session = ctx.context.session;
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (newPassword.length < minPasswordLength) {
-		ctx.context.logger.warn("Password is too short");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	}
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (newPassword.length > maxPasswordLength) {
-		ctx.context.logger.warn("Password is too long");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-	}
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, currentPassword);
 	const account = await ctx.context.internalAdapter.findCredentialAccount(session.user.id);
 	if (!account || !account.password) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND);
 	const passwordHash = await ctx.context.password.hash(newPassword);
@@ -203,16 +197,8 @@ newPassword: z.string().meta({ description: "The new password to set is required
 }, async (ctx) => {
 	const { newPassword } = ctx.body;
 	const session = ctx.context.session;
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (newPassword.length < minPasswordLength) {
-		ctx.context.logger.warn("Password is too short");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	}
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (newPassword.length > maxPasswordLength) {
-		ctx.context.logger.warn("Password is too long");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-	}
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
 	const account = await ctx.context.internalAdapter.findCredentialAccount(session.user.id);
 	const passwordHash = await ctx.context.password.hash(newPassword);
 	if (!account) {
@@ -295,6 +281,7 @@ const deleteUser = createAuthEndpoint("/delete-user", {
 	}
 	const session = ctx.context.session;
 	if (ctx.body.password) {
+		assertPasswordNotTooLong(ctx, ctx.body.password);
 		const account = await ctx.context.internalAdapter.findCredentialAccount(session.user.id);
 		if (!account || !account.password) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND);
 		if (!await ctx.context.password.verify({

package/dist/client/query-atom.mjs

@@ -0,0 +1,13 @@
+import { atom } from "nanostores";
+//#region src/client/query-atom.ts
+const kAuthQuery = Symbol.for("better-auth:auth-query");
+function isAuthQueryStore(store) {
+	return kAuthQuery in store && store[kAuthQuery] === true;
+}
+function createAuthQueryAtom(initialValue) {
+	const queryAtom = atom(initialValue);
+	Object.defineProperty(queryAtom, kAuthQuery, { value: true });
+	return queryAtom;
+}
+//#endregion
+export { createAuthQueryAtom, isAuthQueryStore };

package/dist/client/query.mjs

@@ -1,12 +1,13 @@
 import { isJsonEqual, withEquality } from "./equality.mjs";
-import { atom, onMount } from "nanostores";
+import { createAuthQueryAtom } from "./query-atom.mjs";
+import { onMount } from "nanostores";
 //#region src/client/query.ts
 const isServer = () => typeof window === "undefined";
 function isAuthQueryStateEqual(a, b) {
 	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
 }
 const useAuthQuery = (initializedAtom, path, $fetch, options) => {
-	const value = atom({
+	const value = createAuthQueryAtom({
 		data: null,
 		error: null,
 		isPending: true,
@@ -14,7 +15,9 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 		refetch: (queryParams) => fn(queryParams)
 	});
 	onMount(value, () => withEquality(value, isAuthQueryStateEqual));
+	let latestRequestId = 0;
 	const fn = async (queryParams) => {
+		const requestId = ++latestRequestId;
 		return new Promise((resolve) => {
 			const opts = typeof options === "function" ? options({
 				data: value.get().data,
@@ -28,15 +31,17 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 					...queryParams?.query
 				},
 				async onSuccess(context) {
-					const current = value.get();
-					const stableData = current.data != null && context.data != null && isJsonEqual(current.data, context.data) ? current.data : context.data;
-					value.set({
-						data: stableData,
-						error: null,
-						isPending: false,
-						isRefetching: false,
-						refetch: value.value.refetch
-					});
+					if (requestId === latestRequestId) {
+						const current = value.get();
+						const stableData = current.data != null && context.data != null && isJsonEqual(current.data, context.data) ? current.data : context.data;
+						value.set({
+							data: stableData,
+							error: null,
+							isPending: false,
+							isRefetching: false,
+							refetch: value.value.refetch
+						});
+					}
 					await opts?.onSuccess?.(context);
 				},
 				async onError(context) {
@@ -44,28 +49,33 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 					const retryAttempts = typeof request.retry === "number" ? request.retry : request.retry?.attempts;
 					const retryAttempt = request.retryAttempt || 0;
 					if (retryAttempts && retryAttempt < retryAttempts) return;
-					const isUnauthorized = context.error.status === 401;
-					value.set({
-						error: context.error,
-						data: isUnauthorized ? null : value.get().data,
-						isPending: false,
-						isRefetching: false,
-						refetch: value.value.refetch
-					});
+					if (requestId === latestRequestId) {
+						const isUnauthorized = context.error.status === 401;
+						value.set({
+							error: context.error,
+							data: isUnauthorized ? null : value.get().data,
+							isPending: false,
+							isRefetching: false,
+							refetch: value.value.refetch
+						});
+					}
 					await opts?.onError?.(context);
 				},
 				async onRequest(context) {
-					const currentValue = value.get();
-					value.set({
-						isPending: currentValue.data === null,
-						data: currentValue.data,
-						error: null,
-						isRefetching: true,
-						refetch: value.value.refetch
-					});
+					if (requestId === latestRequestId) {
+						const currentValue = value.get();
+						value.set({
+							isPending: currentValue.data === null,
+							data: currentValue.data,
+							error: null,
+							isRefetching: true,
+							refetch: value.value.refetch
+						});
+					}
 					await opts?.onRequest?.(context);
 				}
 			}).catch((error) => {
+				if (requestId !== latestRequestId) return;
 				value.set({
 					error,
 					data: value.get().data,

package/dist/client/react/react-store.mjs

@@ -1,3 +1,4 @@
+import { isAuthQueryStore } from "../query-atom.mjs";
 import { listenKeys } from "nanostores";
 import { useCallback, useRef, useSyncExternalStore } from "react";
 //#region src/client/react/react-store.ts
@@ -38,7 +39,7 @@ function useStore(store, options = {}) {
 		return store.listen(emitChange);
 	}, deps);
 	const get = () => snapshotRef.current;
-	return useSyncExternalStore(subscribe, get, get);
+	return useSyncExternalStore(subscribe, get, isAuthQueryStore(store) ? () => store.init : get);
 }
 //#endregion
 export { useStore };

package/dist/client/session-atom.mjs

@@ -1,4 +1,5 @@
 import { isJsonEqual, withEquality } from "./equality.mjs";
+import { createAuthQueryAtom } from "./query-atom.mjs";
 import { createSessionRefreshManager } from "./session-refresh.mjs";
 import { STORE_UNMOUNT_DELAY, atom, onMount } from "nanostores";
 //#region src/client/session-atom.ts
@@ -44,7 +45,7 @@ function getSessionAtom($fetch, options) {
 		freshUntil = 0;
 	});
 	const refetch = (queryParams) => fetchSession(queryParams);
-	const session = atom({
+	const session = createAuthQueryAtom({
 		data: null,
 		error: null,
 		isPending: true,

package/dist/context/create-context.mjs

@@ -15,7 +15,7 @@ import { getAuthTables } from "@better-auth/core/db";
 import { createLogger, env, isProduction, isTest } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
-import { schemaCheckFor } from "@better-auth/core/db/internal";
+import { runtimeSchemaCheckFor, schemaCheckFor } from "@better-auth/core/db/internal";
 import { socialProviders } from "@better-auth/core/social-providers";
 import { findInvalidTrustedProxies } from "@better-auth/core/utils/ip";
 import { createTelemetry } from "@better-auth/telemetry";
@@ -228,7 +228,8 @@ Most of the features of Better Auth will not work correctly.`);
 	};
 	const initOrPromise = runPluginInit(ctx);
 	if (isPromise(initOrPromise)) await initOrPromise;
-	ctx.checkSchema = schemaCheckFor(ctx.adapter);
+	ctx.checkSchema = runtimeSchemaCheckFor(ctx.adapter);
+	ctx.explicitSchemaCheck = schemaCheckFor(ctx.adapter);
 	return ctx;
 }
 //#endregion

package/dist/oauth2/index.d.mts

@@ -1,5 +1,5 @@
 import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "./state.mjs";
-import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount } from "./link-account.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
 export * from "@better-auth/core/oauth2";
-export { GenerateStateOptions, applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };
+export { GenerateStateOptions, applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, linkOAuthAccount, parseState, setTokenUtil };

package/dist/oauth2/index.mjs

@@ -1,5 +1,5 @@
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
-import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount } from "./link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./state.mjs";
 export * from "@better-auth/core/oauth2";
-export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };
+export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, linkOAuthAccount, parseState, setTokenUtil };

package/dist/oauth2/link-account.d.mts

@@ -2,9 +2,49 @@ import { Account, User } from "../types/models.mjs";
 import { GenericEndpointContext, UserProvisioningSource } from "@better-auth/core";
 
 //#region src/oauth2/link-account.d.ts
+type OAuthAccountData = Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+/**
+ * Provider profile a freshly linked account may copy onto the local user.
+ * `email` and `emailVerified` are identity anchors and are stripped before
+ * the remaining fields are written. Provider identity is resolved separately
+ * from the raw profile through the provider's account-key contract.
+ */
+type LinkedProviderProfile = {
+  name?: string | undefined;
+  email?: string | null | undefined;
+  emailVerified?: boolean | undefined;
+  image?: string | null | undefined;
+};
+interface LinkOAuthAccountOptions {
+  link: {
+    userId: string;
+    email: string;
+  };
+  userInfo: LinkedProviderProfile;
+  account: OAuthAccountData;
+  profile: Record<string, unknown>;
+  scopes?: string[] | undefined;
+}
+interface LinkOAuthAccountFailure {
+  linked: false;
+  error: {
+    code: string;
+    message?: string | undefined;
+  };
+}
+type LinkOAuthAccountResult = {
+  linked: true;
+} | LinkOAuthAccountFailure;
+declare function linkOAuthAccount(c: GenericEndpointContext, {
+  link,
+  userInfo,
+  account,
+  profile,
+  scopes
+}: LinkOAuthAccountOptions): Promise<LinkOAuthAccountResult>;
 declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
   userInfo: Omit<User, "createdAt" | "updatedAt">;
-  account: Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+  account: OAuthAccountData;
   callbackURL?: string | undefined;
   disableSignUp?: boolean | undefined;
   overrideUserInfo?: boolean | undefined;
@@ -67,18 +107,6 @@ declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
     password?: string | null | undefined;
   } | null;
 }>;
-/**
- * Provider profile a freshly linked account may copy onto the local user.
- * `email` and `emailVerified` are identity anchors and are stripped before
- * the remaining fields are written. Provider identity is resolved separately
- * from the raw profile through the provider's account-key contract.
- */
-type LinkedProviderProfile = {
-  name?: string | undefined;
-  email?: string | null | undefined;
-  emailVerified?: boolean | undefined;
-  image?: string | null | undefined;
-};
 /**
  * Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
  * copy the freshly linked provider's profile onto the local user, matching the
@@ -93,4 +121,4 @@ type LinkedProviderProfile = {
  */
 declare function applyUpdateUserInfoOnLink(c: GenericEndpointContext, userId: string, userInfo: LinkedProviderProfile): Promise<User | undefined>;
 //#endregion
-export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount };

package/dist/oauth2/link-account.mjs

@@ -8,7 +8,67 @@ import { createEmailVerificationToken } from "../api/routes/email-verification.m
 import { queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
 import { isDevelopment } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
+import { mergeScopes } from "@better-auth/core/oauth2";
 //#region src/oauth2/link-account.ts
+function linkOAuthAccountFailure(code, message) {
+	return {
+		linked: false,
+		error: {
+			code,
+			message
+		}
+	};
+}
+async function linkOAuthAccount(c, { link, userInfo, account, profile, scopes }) {
+	try {
+		await assertValidUserInfo(c, {
+			user: {
+				...userInfo,
+				id: link.userId,
+				email: userInfo.email ?? void 0
+			},
+			source: {
+				action: "link-account",
+				method: "oauth",
+				oauth: {
+					providerId: account.providerId,
+					profile
+				}
+			}
+		});
+	} catch (error) {
+		if (!isAPIError(error) || !error.body?.code) throw error;
+		return linkOAuthAccountFailure(error.body.code, error.body.message);
+	}
+	if (!c.context.trustedProviders.includes(account.providerId) && !userInfo.emailVerified || c.context.options.account?.accountLinking?.enabled === false) {
+		c.context.logger.error("Unable to link account - untrusted provider");
+		return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
+	}
+	if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.EMAIL_DOES_NOT_MATCH);
+	const existingAccount = await c.context.internalAdapter.findAccountByKey(account);
+	if (existingAccount) {
+		if (existingAccount.userId.toString() !== link.userId.toString()) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.ACCOUNT_ALREADY_LINKED_TO_DIFFERENT_USER);
+		const mergedScope = mergeScopes(existingAccount.scope, scopes);
+		const updateData = Object.fromEntries(Object.entries({
+			providerId: account.providerId,
+			accessToken: await setTokenUtil(account.accessToken, c.context),
+			refreshToken: await setTokenUtil(account.refreshToken, c.context),
+			idToken: account.idToken,
+			accessTokenExpiresAt: account.accessTokenExpiresAt,
+			refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+			scope: mergedScope || void 0
+		}).filter(([_, value]) => value !== void 0));
+		await c.context.internalAdapter.updateAccount(existingAccount.id, updateData);
+	} else if (!await c.context.internalAdapter.createAccount({
+		userId: link.userId,
+		...account,
+		accessToken: await setTokenUtil(account.accessToken, c.context),
+		refreshToken: await setTokenUtil(account.refreshToken, c.context),
+		scope: scopes?.join(",") ?? account.scope
+	})) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
+	await applyUpdateUserInfoOnLink(c, link.userId, userInfo);
+	return { linked: true };
+}
 async function handleOAuthUserInfo(c, opts) {
 	const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
 	const source = opts.source ?? {
@@ -326,4 +386,4 @@ async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
 	}
 }
 //#endregion
-export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount };

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.5";
+var version = "1.7.6";
 //#endregion
 export { version };

package/dist/plugins/admin/admin.mjs

@@ -42,8 +42,10 @@ const admin = (options) => {
 							});
 							return;
 						}
+						const bannedUserMessage = opts.bannedUserMessage;
+						const message = typeof bannedUserMessage === "function" ? await bannedUserMessage(user) : bannedUserMessage;
 						throw APIError.from("FORBIDDEN", {
-							message: opts.bannedUserMessage,
+							message,
 							code: "BANNED_USER"
 						});
 					}

package/dist/plugins/admin/routes.mjs

@@ -2,6 +2,7 @@ import { parseSessionOutput, parseUserOutput } from "../../db/schema.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { deleteSessionCookie, expireCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getAuthoritativeSessionFromCtx, getSessionFromCtx } from "../../api/routes/session.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { ADMIN_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermission } from "./has-permission.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -190,6 +191,7 @@ const createUser = (opts) => createAuthEndpoint("/admin/create-user", {
 	}
 	const email = ctx.body.email.toLowerCase();
 	if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
+	if (ctx.body.password) assertPasswordNotTooLong(ctx, ctx.body.password);
 	if (await ctx.context.internalAdapter.findUserByEmail(email)) throw APIError.from("BAD_REQUEST", ADMIN_ERROR_CODES.USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL);
 	const user = await ctx.context.internalAdapter.createUser({
 		...userData,
@@ -823,16 +825,8 @@ const setUserPassword = (opts) => createAuthEndpoint("/admin/set-user-password",
 		permissions: { user: ["set-password"] }
 	})) throw APIError.from("FORBIDDEN", ADMIN_ERROR_CODES.YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD);
 	const { newPassword, userId } = ctx.body;
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (newPassword.length < minPasswordLength) {
-		ctx.context.logger.warn("Password is too short");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	}
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (newPassword.length > maxPasswordLength) {
-		ctx.context.logger.warn("Password is too long");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-	}
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
 	const user = await ctx.context.internalAdapter.findUserById(userId);
 	if (!user) throw APIError.from("NOT_FOUND", BASE_ERROR_CODES.USER_NOT_FOUND);
 	const hashedPassword = await ctx.context.password.hash(newPassword);

package/dist/plugins/admin/types.d.mts

@@ -2,6 +2,7 @@ import { Session, User } from "../../types/models.mjs";
 import { InferOptionSchema } from "../../types/plugins.mjs";
 import { AccessControl, Role } from "../access/types.mjs";
 import { AdminSchema } from "./schema.mjs";
+import { Awaitable } from "@better-auth/core";
 
 //#region src/plugins/admin/types.d.ts
 interface UserWithRole extends User {
@@ -70,8 +71,10 @@ interface AdminOptions {
    * Message to show when a user is banned
    *
    * By default, the message is "You have been banned from this application"
+   *
+   * Can also be a function that receives the banned user and returns a message.
    */
-  bannedUserMessage?: string | undefined;
+  bannedUserMessage?: string | ((user: UserWithRole & Record<string, unknown>) => Awaitable<string>) | undefined;
   /**
    * Whether to allow impersonating other admins.
    *

package/dist/plugins/captcha/constants.d.mts

@@ -4,6 +4,7 @@ declare const Providers: {
   readonly GOOGLE_RECAPTCHA: "google-recaptcha";
   readonly HCAPTCHA: "hcaptcha";
   readonly CAPTCHAFOX: "captchafox";
+  readonly VERCEL_BOTID: "vercel-botid";
 };
 //#endregion
 export { Providers };

package/dist/plugins/captcha/constants.mjs

@@ -15,7 +15,8 @@ const Providers = {
 	CLOUDFLARE_TURNSTILE: "cloudflare-turnstile",
 	GOOGLE_RECAPTCHA: "google-recaptcha",
 	HCAPTCHA: "hcaptcha",
-	CAPTCHAFOX: "captchafox"
+	CAPTCHAFOX: "captchafox",
+	VERCEL_BOTID: "vercel-botid"
 };
 const siteVerifyMap = {
 	[Providers.CLOUDFLARE_TURNSTILE]: "https://challenges.cloudflare.com/turnstile/v0/siteverify",

package/dist/plugins/captcha/index.d.mts

@@ -1,4 +1,4 @@
-import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./types.mjs";
+import { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions } from "./types.mjs";
 import * as _$_better_auth_core0 from "@better-auth/core";
 import * as _$_better_auth_core_utils_error_codes0 from "@better-auth/core/utils/error-codes";
 
@@ -24,4 +24,4 @@ declare const captcha: (options: CaptchaOptions) => {
   options: CaptchaOptions;
 };
 //#endregion
-export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, captcha };
+export { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions, captcha };

package/dist/plugins/captcha/index.mjs

@@ -7,6 +7,7 @@ import { captchaFox } from "./verify-handlers/captchafox.mjs";
 import { cloudflareTurnstile } from "./verify-handlers/cloudflare-turnstile.mjs";
 import { googleRecaptcha } from "./verify-handlers/google-recaptcha.mjs";
 import { hCaptcha } from "./verify-handlers/h-captcha.mjs";
+import { vercelBotId } from "./verify-handlers/vercel-botid.mjs";
 import { getIP } from "@better-auth/core/utils/ip";
 //#region src/plugins/captcha/index.ts
 const normalizeEndpointPath = (pathname, basePath) => {
@@ -26,6 +27,11 @@ const captcha = (options) => ({
 			const basePath = ctx.options.basePath ?? "/api/auth";
 			const pathname = normalizeEndpointPath(url.pathname, basePath);
 			if (!endpoints.some((endpoint) => endpoint.includes("*") ? wildcardMatch(endpoint)(pathname) : endpoint === pathname)) return;
+			if (options.provider === Providers.VERCEL_BOTID) return await vercelBotId({
+				request,
+				checkBotId: options.checkBotId,
+				validateRequest: options.validateRequest
+			});
 			if (!options.secretKey) throw new Error(INTERNAL_ERROR_CODES.MISSING_SECRET_KEY.message);
 			const captchaResponse = request.headers.get("x-captcha-response");
 			const remoteUserIP = getIP(request, ctx.options) ?? void 0;

package/dist/plugins/captcha/types.d.mts

@@ -47,6 +47,48 @@ interface CaptchaFoxOptions extends BaseCaptchaOptions {
   provider: typeof Providers.CAPTCHAFOX;
   siteKey?: string | undefined;
 }
-type CaptchaOptions = GoogleRecaptchaOptions | CloudflareTurnstileOptions | HCaptchaOptions | CaptchaFoxOptions;
+/**
+ * BotID verdict fields available to custom request validation.
+ *
+ * @see https://vercel.com/docs/botid/verified-bots
+ */
+type BotIdVerification = {
+  isBot: boolean;
+  isVerifiedBot?: boolean | undefined;
+  verifiedBotName?: string | undefined;
+  verifiedBotCategory?: string | undefined;
+};
+type ValidateRequestContext = {
+  request: Request;
+  verification: BotIdVerification;
+};
+/**
+ * Protect auth requests with Vercel BotID. The browser must also protect the
+ * same request paths and methods with BotID's client SDK.
+ *
+ * @see https://vercel.com/docs/botid/get-started
+ */
+interface VercelBotIdOptions {
+  provider: typeof Providers.VERCEL_BOTID;
+  /**
+   * Auth paths to verify, without the Better Auth base path.
+   *
+   * @default ["/sign-up/email", "/sign-in/email", "/request-password-reset"]
+   */
+  endpoints?: string[] | undefined;
+  /**
+   * Vercel's server-side check for the current request. Pass `checkBotId` from
+   * `botid/server`, or wrap it to supply SDK options.
+   */
+  checkBotId: () => Promise<BotIdVerification>;
+  /**
+   * Override the default `isBot === false` decision. Return `true` to allow
+   * the request, including a verified bot you trust.
+   *
+   * @see https://vercel.com/docs/botid/verified-bots
+   */
+  validateRequest?: (ctx: ValidateRequestContext) => boolean | Promise<boolean>;
+}
+type CaptchaOptions = GoogleRecaptchaOptions | CloudflareTurnstileOptions | HCaptchaOptions | CaptchaFoxOptions | VercelBotIdOptions;
 //#endregion
-export { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider };
+export { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions };

package/dist/plugins/captcha/utils.mjs

@@ -5,5 +5,15 @@ const encodeToURLParams = (obj) => {
 	for (const [key, value] of Object.entries(obj)) if (value !== void 0 && value !== null) params.append(key, String(value));
 	return params.toString();
 };
+/**
+* Rejects after `timeoutMs` without cancelling the underlying promise.
+*/
+const withTimeout = (promise, timeoutMs) => {
+	let timer;
+	const timeout = new Promise((_resolve, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error("Operation timed out")), timeoutMs);
+	});
+	return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+};
 //#endregion
-export { encodeToURLParams };
+export { encodeToURLParams, withTimeout };

package/dist/plugins/captcha/verify-handlers/vercel-botid.mjs

@@ -0,0 +1,27 @@
+import { middlewareResponse } from "../../../utils/middleware-response.mjs";
+import { CAPTCHA_VERIFY_TIMEOUT_MS } from "../constants.mjs";
+import { EXTERNAL_ERROR_CODES, INTERNAL_ERROR_CODES } from "../error-codes.mjs";
+import { withTimeout } from "../utils.mjs";
+//#region src/plugins/captcha/verify-handlers/vercel-botid.ts
+const vercelBotId = async ({ request, checkBotId, validateRequest }) => {
+	let isValid;
+	try {
+		isValid = await withTimeout((async () => {
+			const verification = await checkBotId();
+			return validateRequest ? validateRequest({
+				request,
+				verification
+			}) : verification.isBot === false;
+		})(), CAPTCHA_VERIFY_TIMEOUT_MS);
+	} catch (error) {
+		throw new Error(INTERNAL_ERROR_CODES.SERVICE_UNAVAILABLE.message, { cause: error });
+	}
+	if (isValid) return void 0;
+	return middlewareResponse({
+		message: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.message,
+		code: EXTERNAL_ERROR_CODES.VERIFICATION_FAILED.code,
+		status: 403
+	});
+};
+//#endregion
+export { vercelBotId };

package/dist/plugins/email-otp/routes.mjs

@@ -6,6 +6,7 @@ import { symmetricDecrypt } from "../../crypto/index.mjs";
 import { setCookieCache, setSessionCookie } from "../../cookies/index.mjs";
 import { revokeUnprovenAccountAccess } from "../../db/revoke-unproven-account-access.mjs";
 import { getSessionFromCtx, sensitiveSessionMiddleware } from "../../api/routes/session.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { APIError as APIError$1 } from "../../api/index.mjs";
 import { EMAIL_OTP_ERROR_CODES } from "./error-codes.mjs";
 import { splitAtLastColon, toOTPIdentifier } from "./utils.mjs";
@@ -581,10 +582,8 @@ const resetPasswordEmailOTP = (opts) => createAuthEndpoint("/email-otp/reset-pas
 	} }
 }, async (ctx) => {
 	const email = ctx.body.email.toLowerCase();
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (ctx.body.password.length < minPasswordLength) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (ctx.body.password.length > maxPasswordLength) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	assertPasswordNotTooShort(ctx, ctx.body.password);
+	assertPasswordNotTooLong(ctx, ctx.body.password);
 	await atomicVerifyOTP(ctx, opts, toOTPIdentifier("forget-password", email), ctx.body.otp);
 	const user = await ctx.context.internalAdapter.findUserByEmail(email);
 	if (!user) throw APIError$1.from("BAD_REQUEST", BASE_ERROR_CODES.USER_NOT_FOUND);

package/dist/plugins/index.d.mts

@@ -10,7 +10,7 @@ import { admin } from "./admin/admin.mjs";
 import { AnonymousOptions, AnonymousSession, UserWithAnonymous } from "./anonymous/types.mjs";
 import { anonymous } from "./anonymous/index.mjs";
 import { BearerOptions, bearer } from "./bearer/index.mjs";
-import { BaseCaptchaOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider } from "./captcha/types.mjs";
+import { BaseCaptchaOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, GoogleRecaptchaOptions, HCaptchaOptions, Provider, ValidateRequestContext, VercelBotIdOptions } from "./captcha/types.mjs";
 import { captcha } from "./captcha/index.mjs";
 import { CustomSessionPluginOptions, customSession } from "./custom-session/index.mjs";
 import { TimeString, ms, sec } from "../utils/time.mjs";
@@ -66,4 +66,4 @@ import { USERNAME_ERROR_CODES } from "./username/error-codes.mjs";
 import { UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, username } from "./username/index.mjs";
 import { hasPermission } from "./organization/has-permission.mjs";
 import { DefaultOrganizationPlugin, DynamicAccessControlEndpoints, OrganizationCreator, OrganizationEndpoints, OrganizationPlugin, TeamEndpoints, organization, parseRoles } from "./organization/organization.mjs";
-export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };
+export { AccessControl, AdminOptions, AnonymousOptions, AnonymousSession, ArrayElement, Auth0Options, AuthorizeResponse, BackupCodeOptions, BaseCaptchaOptions, BaseOAuthProviderOptions, BearerOptions, BotIdVerification, CaptchaFoxOptions, CaptchaOptions, CloudflareTurnstileOptions, CustomSessionPluginOptions, DefaultOrganizationPlugin, DeviceAuthorizationGrant, DeviceAuthorizationGrantAuthorization, DeviceAuthorizationOptions, DeviceAuthorizationPluginOptions, DeviceAuthorizationRequest, DeviceCode, DeviceCodeRedemptionAuthorization, DeviceCodeRedemptionResult, DynamicAccessControlEndpoints, MULTI_SESSION_ERROR_CODES as ERROR_CODES, EmailOTPOptions, ExactRoleStatements, FieldSchema, GenericOAuthConfig, GenericOAuthOptions, GenericOAuthUserInfo, GoogleRecaptchaOptions, GumroadOptions, HCaptchaOptions, HIDE_METADATA, HaveIBeenPwnedOptions, HubSpotOptions, InferAdminRolesFromOption, InferInvitation, InferMember, InferOptionSchema, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferPluginContext, InferPluginErrorCodes, InferPluginIDs, InferTeam, Invitation, InvitationInput, InvitationStatus, JWKOptions, JWSAlgorithms, Jwk, JwtOptions, KeycloakOptions, LastLoginMethodOptions, LineOptions, LoginResult, MagicLinkOptions, Member, MemberInput, MicrosoftEntraIdOptions, MultiSessionConfig, OAUTH_POPUP_COMPLETE_SCRIPT, OAUTH_POPUP_DATA_ELEMENT_ID, OAUTH_POPUP_ERROR_CODES, OAUTH_POPUP_MESSAGE_TYPE, OAUTH_POPUP_SCRIPT_CSP_HASH, OAuthPopupData, OAuthPopupMessage, OAuthProxyOptions, OTPOptions, OktaOptions, OneTapOptions, OneTimeTokenOptions, OpenAPIModelSchema, OpenAPIOptions, OpenAPIParameter, OpenAPISchema, Organization, OrganizationCreator, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, POPUP_MARKER_COOKIE, Path, PatreonOptions, PhoneNumberOptions, Provider, ResolvedSigningKey, Role, RoleAuthorizeRequest, RoleInput, RoleStatements, SIWEPluginOptions, SessionWithImpersonatedBy, SlackOptions, Statements, SubArray, Subset, TOTPOptions, TWO_FACTOR_ERROR_CODES, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, TestAuthOptions, TestCookie, TestHelpers, TestUtilsOptions, TimeString, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, USERNAME_ERROR_CODES, UserWithAnonymous, UserWithPhoneNumber, UserWithRole, UserWithTwoFactor, UsernameOptions, UsernamePlugin, UsernamePluginWithoutDisplayUsername, ValidateRequestContext, VercelBotIdOptions, YandexOptions, admin, anonymous, auth0, backupCode2fa, bearer, captcha, createAccessControl, createJwk, customSession, defaultRolesSchema, deviceAuthorization, deviceAuthorizationOptionsSchema, emailOTP, encodeBackupCodes, generateBackupCodes, generateExportedKeyPair, generator, genericOAuth, getBackupCodes, getJwtToken, getOrgAdapter, gumroad, hasPermission, haveIBeenPwned, hubspot, invitationSchema, invitationStatus, isPasswordCompromised, jwt, keycloak, lastLoginMethod, line, magicLink, memberSchema, microsoftEntraId, ms, multiSession, oAuthProxy, oauthPopup, okta, oneTap, oneTimeToken, openAPI, organization, organizationRoleSchema, organizationSchema, otp2fa, parseRoles, patreon, phoneNumber, redeemDeviceCode, resolveSigningKey, role, roleSchema, sec, signJWT, siwe, slack, teamMemberSchema, teamSchema, testUtils, toExpJWT, totp2fa, twoFactor, twoFactorClient, username, verifyBackupCode, verifyJWT, yandex };

package/dist/plugins/oauth-proxy/index.mjs

@@ -7,7 +7,7 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { redirectOnError } from "../../oauth2/errors.mjs";
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
-import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { setOAuthState } from "../../api/state/oauth.mjs";
 import { parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
@@ -37,6 +37,7 @@ const passthroughPayloadSchema = z.looseObject({
 		updatedAt: true
 	}).shape),
 	profile: z.record(z.string(), z.unknown()).optional(),
+	scopes: z.array(z.string()).optional(),
 	state: z.string().min(1),
 	callbackURL: z.string().min(1),
 	newUserURL: z.string().optional(),
@@ -107,7 +108,19 @@ const oAuthProxy = (opts) => {
 			ctx.context.logger.error(`OAuth proxy payload expired or invalid (age: ${age}s, maxAge: ${maxAge}s)`);
 			throw redirectOnError(ctx, errorURL, "payload_expired");
 		}
-		if (!await restoreOAuthProxyState(ctx, payload.state)) throw redirectOnError(ctx, errorURL, "state_mismatch");
+		const stateData = await restoreOAuthProxyState(ctx, payload.state);
+		if (!stateData) throw redirectOnError(ctx, errorURL, "state_mismatch");
+		if (stateData.link) {
+			const linkResult = await linkOAuthAccount(ctx, {
+				link: stateData.link,
+				userInfo: payload.userInfo,
+				account: payload.account,
+				profile: payload.profile ?? {},
+				scopes: payload.scopes ?? payload.account.scope?.split(",")
+			});
+			if (!linkResult.linked) throw redirectOnError(ctx, errorURL, linkResult.error.code, linkResult.error.message);
+			throw ctx.redirect(payload.callbackURL);
+		}
 		let result;
 		try {
 			result = await handleOAuthUserInfo(ctx, {
@@ -185,7 +198,7 @@ const oAuthProxy = (opts) => {
 		hooks: {
 			before: [{
 				matcher(context) {
-					return !!context.path?.startsWith("/sign-in/social");
+					return !!context.path?.startsWith("/sign-in/social") || context.path === "/link-social";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					if (checkSkipProxy(ctx, opts)) return;
@@ -307,6 +320,7 @@ const oAuthProxy = (opts) => {
 							emailVerified: userInfo.emailVerified
 						},
 						profile: providerProfile,
+						scopes: tokens.scopes,
 						account: {
 							...accountKey,
 							accessToken: tokens.accessToken,
@@ -333,14 +347,14 @@ const oAuthProxy = (opts) => {
 			}],
 			after: [{
 				matcher(context) {
-					return !!context.path?.startsWith("/sign-in/social");
+					return !!context.path?.startsWith("/sign-in/social") || context.path === "/link-social";
 				},
 				handler: createAuthMiddleware(async (ctx) => {
 					if (checkSkipProxy(ctx, opts)) return;
 					const signInResponse = ctx.context.returned;
 					if (!signInResponse || typeof signInResponse !== "object" || !("url" in signInResponse)) return;
 					const { url: providerURL } = signInResponse;
-					if (typeof providerURL !== "string") return;
+					if (typeof providerURL !== "string" || providerURL.length === 0) return;
 					const oauthURL = new URL(providerURL);
 					const originalState = oauthURL.searchParams.get("state");
 					if (!originalState) return;

package/dist/plugins/phone-number/routes.mjs

@@ -4,6 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -54,6 +55,7 @@ const signInPhoneNumber = (opts) => createAuthEndpoint("/sign-in/phone-number",
 	if (opts.phoneNumberValidator) {
 		if (!await opts.phoneNumberValidator(ctx.body.phoneNumber)) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.INVALID_PHONE_NUMBER);
 	}
+	assertPasswordNotTooLong(ctx, password);
 	const user = await ctx.context.adapter.findOne({
 		model: "user",
 		where: [{
@@ -466,10 +468,8 @@ const resetPasswordPhoneNumber = (opts) => createAuthEndpoint("/phone-number/res
 		}]
 	});
 	if (!user) throw APIError.from("BAD_REQUEST", PHONE_NUMBER_ERROR_CODES.UNEXPECTED_ERROR);
-	const minLength = ctx.context.password.config.minPasswordLength;
-	const maxLength = ctx.context.password.config.maxPasswordLength;
-	if (ctx.body.newPassword.length < minLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	if (ctx.body.newPassword.length > maxLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	assertPasswordNotTooShort(ctx, ctx.body.newPassword);
+	assertPasswordNotTooLong(ctx, ctx.body.newPassword);
 	const hashedPassword = await ctx.context.password.hash(ctx.body.newPassword);
 	if (!await ctx.context.internalAdapter.findCredentialAccount(user.id)) await ctx.context.internalAdapter.createAccount({
 		userId: user.id,

package/dist/plugins/username/index.mjs

@@ -2,6 +2,7 @@ import { mergeSchema, parseUserOutput } from "../../db/schema.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { createEmailVerificationToken } from "../../api/routes/email-verification.mjs";
+import { assertPasswordNotTooLong } from "../../utils/password.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { USERNAME_ERROR_CODES } from "./error-codes.mjs";
 import { getSchema } from "./schema.mjs";
@@ -166,6 +167,7 @@ const usernameImpl = (options, includeDisplayUsername) => {
 					throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.USERNAME_TOO_LONG);
 				}
 				if (!await (options?.usernameValidator || defaultUsernameValidator)(username)) throw APIError.from("UNPROCESSABLE_ENTITY", USERNAME_ERROR_CODES.INVALID_USERNAME);
+				assertPasswordNotTooLong(ctx, ctx.body.password);
 				const user = await ctx.context.adapter.findOne({
 					model: "user",
 					where: [{

package/dist/utils/password.mjs

@@ -1,6 +1,19 @@
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 //#region src/utils/password.ts
+function assertPasswordNotTooShort(ctx, password) {
+	if (password.length < ctx.context.password.config.minPasswordLength) {
+		ctx.context.logger.warn("Password is too short");
+		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
+	}
+}
+function assertPasswordNotTooLong(ctx, password) {
+	if (password.length > ctx.context.password.config.maxPasswordLength) {
+		ctx.context.logger.warn("Password is too long");
+		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	}
+}
 async function validatePassword(ctx, data) {
+	assertPasswordNotTooLong(ctx, data.password);
 	const credentialAccount = await ctx.context.internalAdapter.findCredentialAccount(data.userId);
 	const currentPassword = credentialAccount?.password;
 	if (!credentialAccount || !currentPassword) return false;
@@ -10,9 +23,10 @@ async function validatePassword(ctx, data) {
 	});
 }
 async function checkPassword(userId, c) {
+	const password = c.body.password;
+	if (typeof password === "string") assertPasswordNotTooLong(c, password);
 	const credentialAccount = await c.context.internalAdapter.findCredentialAccount(userId);
 	const currentPassword = credentialAccount?.password;
-	const password = c.body.password;
 	if (!credentialAccount || !currentPassword || !password) {
 		if (password) await c.context.password.hash(password);
 		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
@@ -29,4 +43,4 @@ async function shouldRequirePassword(ctx, userId, allowPasswordless) {
 	return Boolean(credentialAccount?.password);
 }
 //#endregion
-export { checkPassword, shouldRequirePassword, validatePassword };
+export { assertPasswordNotTooLong, assertPasswordNotTooShort, checkPassword, shouldRequirePassword, validatePassword };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -473,13 +473,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.5",
-    "@better-auth/drizzle-adapter": "1.7.5",
-    "@better-auth/kysely-adapter": "1.7.5",
-    "@better-auth/memory-adapter": "1.7.5",
-    "@better-auth/mongo-adapter": "1.7.5",
-    "@better-auth/prisma-adapter": "1.7.5",
-    "@better-auth/telemetry": "1.7.5"
+    "@better-auth/core": "1.7.6",
+    "@better-auth/drizzle-adapter": "1.7.6",
+    "@better-auth/kysely-adapter": "1.7.6",
+    "@better-auth/memory-adapter": "1.7.6",
+    "@better-auth/mongo-adapter": "1.7.6",
+    "@better-auth/prisma-adapter": "1.7.6",
+    "@better-auth/telemetry": "1.7.6"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",
@@ -494,6 +494,7 @@
     "@types/pg": "^8.20.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
+    "botid": "^1.5.10",
     "happy-dom": "^20.8.9",
     "msw": "^2.14.6",
     "next": "^16.3.4",