better-auth 1.7.5 → 1.7.7

package/dist/api/rate-limiter/index.mjs

@@ -65,7 +65,10 @@ function rateLimitResponse(retryAfter) {
 	return new Response(JSON.stringify({ message: "Too many requests. Please try again later." }), {
 		status: 429,
 		statusText: "Too Many Requests",
-		headers: { "X-Retry-After": retryAfter.toString() }
+		headers: {
+			"Content-Type": "application/json",
+			"X-Retry-After": retryAfter.toString()
+		}
 	});
 }
 function getRetryAfter(lastRequest, window) {

package/dist/api/routes/callback.mjs

@@ -1,14 +1,12 @@
 import { isAPIError } from "../../utils/is-api-error.mjs";
 import { setSessionCookie } from "../../cookies/index.mjs";
-import { assertValidUserInfo } from "../../utils/validate-user-info.mjs";
 import { getAwaitableValue } from "../../context/helpers.mjs";
 import { resolveOAuthAccountKey, toOAuthProfileRecord } from "../../oauth2/account-key.mjs";
 import { OAUTH_CALLBACK_ERROR_CODES, missingEmailLogMessage } from "../../oauth2/errors.mjs";
-import { getOAuthCallbackPath, setTokenUtil } from "../../oauth2/utils.mjs";
-import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
+import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "../../oauth2/state.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
-import { mergeScopes } from "@better-auth/core/oauth2";
 import { safeJSONParse } from "@better-auth/core/utils/json";
 import { appendQueryParams } from "@better-auth/core/utils/url";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -149,72 +147,26 @@ const callbackOAuth = createAuthEndpoint("/callback/:id", {
 		c.context.logger.error("No callback URL found");
 		throw redirectOnError(OAUTH_CALLBACK_ERROR_CODES.NO_CALLBACK_URL);
 	}
+	const accountData = {
+		...accountKey,
+		...tokens,
+		scope: tokens.scopes?.join(",")
+	};
 	if (link) {
-		try {
-			await assertValidUserInfo(c, {
-				user: {
-					...userInfo,
-					id: link.userId,
-					email: userInfo.email ?? void 0
-				},
-				source: {
-					action: "link-account",
-					method: "oauth",
-					oauth: {
-						providerId: provider.id,
-						profile: providerProfile
-					}
-				}
-			});
-		} catch (e) {
-			if (isAPIError(e) && e.body?.code) throw redirectOnError(e.body.code, e.body.message);
-			throw e;
-		}
-		if (!c.context.trustedProviders.includes(provider.id) && !userInfo.emailVerified || c.context.options.account?.accountLinking?.enabled === false) {
-			c.context.logger.error("Unable to link account - untrusted provider");
-			return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
-		}
-		if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.EMAIL_DOES_NOT_MATCH);
-		const existingAccount = await c.context.internalAdapter.findAccountByKey(accountKey);
-		if (existingAccount) {
-			if (existingAccount.userId.toString() !== link.userId.toString()) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.ACCOUNT_ALREADY_LINKED_TO_DIFFERENT_USER);
-			const mergedScope = mergeScopes(existingAccount.scope, tokens.scopes);
-			const updateData = Object.fromEntries(Object.entries({
-				providerId: provider.id,
-				accessToken: await setTokenUtil(tokens.accessToken, c.context),
-				refreshToken: await setTokenUtil(tokens.refreshToken, c.context),
-				idToken: tokens.idToken,
-				accessTokenExpiresAt: tokens.accessTokenExpiresAt,
-				refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
-				scope: mergedScope || void 0
-			}).filter(([_, value]) => value !== void 0));
-			await c.context.internalAdapter.updateAccount(existingAccount.id, updateData);
-		} else if (!await c.context.internalAdapter.createAccount({
-			userId: link.userId,
-			...accountKey,
-			...tokens,
-			accessToken: await setTokenUtil(tokens.accessToken, c.context),
-			refreshToken: await setTokenUtil(tokens.refreshToken, c.context),
-			scope: tokens.scopes?.join(",")
-		})) return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
-		await applyUpdateUserInfoOnLink(c, link.userId, userInfo);
-		let toRedirectTo;
-		try {
-			toRedirectTo = callbackURL.toString();
-		} catch {
-			toRedirectTo = callbackURL;
-		}
-		throw c.redirect(toRedirectTo);
+		const linkResult = await linkOAuthAccount(c, {
+			link,
+			userInfo,
+			account: accountData,
+			profile: providerProfile,
+			scopes: tokens.scopes
+		});
+		if (!linkResult.linked) return redirectOnError(linkResult.error.code, linkResult.error.message);
+		throw c.redirect(callbackURL);
 	}
 	if (!userInfo.email) {
 		c.context.logger.error(missingEmailLogMessage(provider.id));
 		return redirectOnError(OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_FOUND);
 	}
-	const accountData = {
-		...accountKey,
-		...tokens,
-		scope: tokens.scopes?.join(",")
-	};
 	let result;
 	try {
 		result = await handleOAuthUserInfo(c, {

package/dist/api/routes/password.mjs

@@ -1,7 +1,7 @@
 import { originCheck } from "../middlewares/origin-check.mjs";
 import { getDate } from "../../utils/date.mjs";
 import { sensitiveSessionMiddleware } from "./session.mjs";
-import { validatePassword } from "../../utils/password.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort, validatePassword } from "../../utils/password.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
 import { createAuthEndpoint } from "@better-auth/core/api";
@@ -149,10 +149,8 @@ const resetPassword = createAuthEndpoint("/reset-password", {
 	const token = ctx.body.token || ctx.query?.token;
 	if (!token) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);
 	const { newPassword } = ctx.body;
-	const minLength = ctx.context.password?.config.minPasswordLength;
-	const maxLength = ctx.context.password?.config.maxPasswordLength;
-	if (newPassword.length < minLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	if (newPassword.length > maxLength) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
 	const id = `reset-password:${token}`;
 	const verification = await ctx.context.internalAdapter.consumeVerificationValue(id);
 	if (!verification) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_TOKEN);

package/dist/api/routes/sign-in.mjs

@@ -9,6 +9,8 @@ import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
 import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
+import { assertPasswordNotTooLong } from "../../utils/password.mjs";
+import "../../utils/index.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -192,7 +194,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 				idToken: token
 			},
 			callbackURL: c.body.callbackURL,
-			disableSignUp: provider.disableImplicitSignUp && !c.body.requestSignUp || provider.disableSignUp,
+			disableSignUp: provider.disableImplicitSignUp && !c.body.requestSignUp || provider.options?.disableSignUp || provider.disableSignUp,
 			source: {
 				method: "oauth",
 				oauth: {
@@ -312,6 +314,7 @@ const signInEmail = () => createAuthEndpoint("/sign-in/email", {
 	}
 	const { email, password } = ctx.body;
 	if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
+	assertPasswordNotTooLong(ctx, password);
 	const userRecord = await ctx.context.internalAdapter.findUserByEmail(email.toLowerCase(), { includeAccounts: true });
 	const credentialAccount = userRecord?.accounts.find((account) => account.providerId === "credential" && account.accountId === userRecord.user.id);
 	if (!userRecord || !credentialAccount) {

package/dist/api/routes/sign-up.mjs

@@ -4,6 +4,7 @@ import { buildSyntheticUserOutput, parseUserInput, parseUserOutput } from "../..
 import { setSessionCookie } from "../../cookies/index.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { runWithTransaction } from "@better-auth/core/context";
 import { isDevelopment } from "@better-auth/core/env";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
@@ -149,16 +150,8 @@ const signUpEmail = () => createAuthEndpoint("/sign-up/email", {
 		const { name, email, password, image, callbackURL: _callbackURL, rememberMe, ...rest } = body;
 		if (!z.email().safeParse(email).success) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_EMAIL);
 		if (!password || typeof password !== "string") throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.INVALID_PASSWORD);
-		const minPasswordLength = ctx.context.password.config.minPasswordLength;
-		if (password.length < minPasswordLength) {
-			ctx.context.logger.warn("Password is too short");
-			throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-		}
-		const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-		if (password.length > maxPasswordLength) {
-			ctx.context.logger.warn("Password is too long");
-			throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-		}
+		assertPasswordNotTooShort(ctx, password);
+		assertPasswordNotTooLong(ctx, password);
 		const shouldReturnGenericDuplicateResponse = ctx.context.options.emailAndPassword.requireEmailVerification || ctx.context.options.emailAndPassword.autoSignIn === false;
 		const shouldSkipAutoSignIn = ctx.context.options.emailAndPassword.autoSignIn === false || shouldReturnGenericDuplicateResponse;
 		const additionalUserFields = parseUserInput(ctx.context.options, rest, "create");

package/dist/api/routes/update-user.mjs

@@ -4,6 +4,7 @@ import { generateRandomString } from "../../crypto/random.mjs";
 import { deleteSessionCookie, setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx, isStateful, sensitiveSessionMiddleware, sessionMiddleware } from "./session.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
+import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";
 import * as z from "zod";
@@ -158,16 +159,9 @@ const changePassword = createAuthEndpoint("/change-password", {
 }, async (ctx) => {
 	const { newPassword, currentPassword, revokeOtherSessions } = ctx.body;
 	const session = ctx.context.session;
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (newPassword.length < minPasswordLength) {
-		ctx.context.logger.warn("Password is too short");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	}
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (newPassword.length > maxPasswordLength) {
-		ctx.context.logger.warn("Password is too long");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-	}
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, currentPassword);
 	const account = await ctx.context.internalAdapter.findCredentialAccount(session.user.id);
 	if (!account || !account.password) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND);
 	const passwordHash = await ctx.context.password.hash(newPassword);
@@ -203,16 +197,8 @@ newPassword: z.string().meta({ description: "The new password to set is required
 }, async (ctx) => {
 	const { newPassword } = ctx.body;
 	const session = ctx.context.session;
-	const minPasswordLength = ctx.context.password.config.minPasswordLength;
-	if (newPassword.length < minPasswordLength) {
-		ctx.context.logger.warn("Password is too short");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_SHORT);
-	}
-	const maxPasswordLength = ctx.context.password.config.maxPasswordLength;
-	if (newPassword.length > maxPasswordLength) {
-		ctx.context.logger.warn("Password is too long");
-		throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.PASSWORD_TOO_LONG);
-	}
+	assertPasswordNotTooShort(ctx, newPassword);
+	assertPasswordNotTooLong(ctx, newPassword);
 	const account = await ctx.context.internalAdapter.findCredentialAccount(session.user.id);
 	const passwordHash = await ctx.context.password.hash(newPassword);
 	if (!account) {
@@ -295,6 +281,7 @@ const deleteUser = createAuthEndpoint("/delete-user", {
 	}
 	const session = ctx.context.session;
 	if (ctx.body.password) {
+		assertPasswordNotTooLong(ctx, ctx.body.password);
 		const account = await ctx.context.internalAdapter.findCredentialAccount(session.user.id);
 		if (!account || !account.password) throw APIError.from("BAD_REQUEST", BASE_ERROR_CODES.CREDENTIAL_ACCOUNT_NOT_FOUND);
 		if (!await ctx.context.password.verify({

package/dist/client/config.mjs

@@ -19,6 +19,7 @@ const resolvePublicAuthUrl = (basePath) => {
 		} catch {}
 	}
 };
+const matchesSessionSignal = (path) => path === "/sign-out" || path === "/update-user" || path === "/update-session" || path === "/sign-up/email" || path === "/sign-in/email" || path === "/delete-user" || path === "/verify-email" || path === "/revoke-sessions" || path === "/revoke-session" || path === "/revoke-other-sessions" || path === "/change-email" || path === "/change-password";
 const getClientConfig = (options, loadEnv) => {
 	const isCredentialsSupported = "credentials" in Request.prototype;
 	const baseURL = getBaseURL(options?.baseURL, options?.basePath, void 0, loadEnv) ?? resolvePublicAuthUrl(options?.basePath) ?? "/api/auth";
@@ -72,9 +73,7 @@ const getClientConfig = (options, loadEnv) => {
 	};
 	const atomListeners = [{
 		signal: "$sessionSignal",
-		matcher(path) {
-			return path === "/sign-out" || path === "/update-user" || path === "/update-session" || path === "/sign-up/email" || path === "/sign-in/email" || path === "/delete-user" || path === "/verify-email" || path === "/revoke-sessions" || path === "/revoke-session" || path === "/revoke-other-sessions" || path === "/change-email" || path === "/change-password";
-		},
+		matcher: matchesSessionSignal,
 		callback(path) {
 			if (path === "/sign-out") broadcastSessionUpdate("signout");
 			else if (path === "/update-user" || path === "/update-session") broadcastSessionUpdate("updateUser");
@@ -110,4 +109,4 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-export { getClientConfig };
+export { getClientConfig, matchesSessionSignal };

package/dist/client/query-atom.mjs

@@ -0,0 +1,13 @@
+import { atom } from "nanostores";
+//#region src/client/query-atom.ts
+const kAuthQuery = Symbol.for("better-auth:auth-query");
+function isAuthQueryStore(store) {
+	return kAuthQuery in store && store[kAuthQuery] === true;
+}
+function createAuthQueryAtom(initialValue) {
+	const queryAtom = atom(initialValue);
+	Object.defineProperty(queryAtom, kAuthQuery, { value: true });
+	return queryAtom;
+}
+//#endregion
+export { createAuthQueryAtom, isAuthQueryStore };

package/dist/client/query.mjs

@@ -1,12 +1,13 @@
 import { isJsonEqual, withEquality } from "./equality.mjs";
-import { atom, onMount } from "nanostores";
+import { createAuthQueryAtom } from "./query-atom.mjs";
+import { onMount } from "nanostores";
 //#region src/client/query.ts
 const isServer = () => typeof window === "undefined";
 function isAuthQueryStateEqual(a, b) {
 	return isJsonEqual(a.data, b.data) && a.error === b.error && a.isPending === b.isPending && a.isRefetching === b.isRefetching && a.refetch === b.refetch;
 }
 const useAuthQuery = (initializedAtom, path, $fetch, options) => {
-	const value = atom({
+	const value = createAuthQueryAtom({
 		data: null,
 		error: null,
 		isPending: true,
@@ -14,7 +15,9 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 		refetch: (queryParams) => fn(queryParams)
 	});
 	onMount(value, () => withEquality(value, isAuthQueryStateEqual));
+	let latestRequestId = 0;
 	const fn = async (queryParams) => {
+		const requestId = ++latestRequestId;
 		return new Promise((resolve) => {
 			const opts = typeof options === "function" ? options({
 				data: value.get().data,
@@ -28,15 +31,17 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 					...queryParams?.query
 				},
 				async onSuccess(context) {
-					const current = value.get();
-					const stableData = current.data != null && context.data != null && isJsonEqual(current.data, context.data) ? current.data : context.data;
-					value.set({
-						data: stableData,
-						error: null,
-						isPending: false,
-						isRefetching: false,
-						refetch: value.value.refetch
-					});
+					if (requestId === latestRequestId) {
+						const current = value.get();
+						const stableData = current.data != null && context.data != null && isJsonEqual(current.data, context.data) ? current.data : context.data;
+						value.set({
+							data: stableData,
+							error: null,
+							isPending: false,
+							isRefetching: false,
+							refetch: value.value.refetch
+						});
+					}
 					await opts?.onSuccess?.(context);
 				},
 				async onError(context) {
@@ -44,28 +49,33 @@ const useAuthQuery = (initializedAtom, path, $fetch, options) => {
 					const retryAttempts = typeof request.retry === "number" ? request.retry : request.retry?.attempts;
 					const retryAttempt = request.retryAttempt || 0;
 					if (retryAttempts && retryAttempt < retryAttempts) return;
-					const isUnauthorized = context.error.status === 401;
-					value.set({
-						error: context.error,
-						data: isUnauthorized ? null : value.get().data,
-						isPending: false,
-						isRefetching: false,
-						refetch: value.value.refetch
-					});
+					if (requestId === latestRequestId) {
+						const isUnauthorized = context.error.status === 401;
+						value.set({
+							error: context.error,
+							data: isUnauthorized ? null : value.get().data,
+							isPending: false,
+							isRefetching: false,
+							refetch: value.value.refetch
+						});
+					}
 					await opts?.onError?.(context);
 				},
 				async onRequest(context) {
-					const currentValue = value.get();
-					value.set({
-						isPending: currentValue.data === null,
-						data: currentValue.data,
-						error: null,
-						isRefetching: true,
-						refetch: value.value.refetch
-					});
+					if (requestId === latestRequestId) {
+						const currentValue = value.get();
+						value.set({
+							isPending: currentValue.data === null,
+							data: currentValue.data,
+							error: null,
+							isRefetching: true,
+							refetch: value.value.refetch
+						});
+					}
 					await opts?.onRequest?.(context);
 				}
 			}).catch((error) => {
+				if (requestId !== latestRequestId) return;
 				value.set({
 					error,
 					data: value.get().data,

package/dist/client/react/react-store.mjs

@@ -1,3 +1,4 @@
+import { isAuthQueryStore } from "../query-atom.mjs";
 import { listenKeys } from "nanostores";
 import { useCallback, useRef, useSyncExternalStore } from "react";
 //#region src/client/react/react-store.ts
@@ -38,7 +39,7 @@ function useStore(store, options = {}) {
 		return store.listen(emitChange);
 	}, deps);
 	const get = () => snapshotRef.current;
-	return useSyncExternalStore(subscribe, get, get);
+	return useSyncExternalStore(subscribe, get, isAuthQueryStore(store) ? () => store.init : get);
 }
 //#endregion
 export { useStore };

package/dist/client/session-atom.mjs

@@ -1,4 +1,5 @@
 import { isJsonEqual, withEquality } from "./equality.mjs";
+import { createAuthQueryAtom } from "./query-atom.mjs";
 import { createSessionRefreshManager } from "./session-refresh.mjs";
 import { STORE_UNMOUNT_DELAY, atom, onMount } from "nanostores";
 //#region src/client/session-atom.ts
@@ -44,7 +45,7 @@ function getSessionAtom($fetch, options) {
 		freshUntil = 0;
 	});
 	const refetch = (queryParams) => fetchSession(queryParams);
-	const session = atom({
+	const session = createAuthQueryAtom({
 		data: null,
 		error: null,
 		isPending: true,

package/dist/context/create-context.mjs

@@ -15,7 +15,7 @@ import { getAuthTables } from "@better-auth/core/db";
 import { createLogger, env, isProduction, isTest } from "@better-auth/core/env";
 import { BetterAuthError } from "@better-auth/core/error";
 import { generateId } from "@better-auth/core/utils/id";
-import { schemaCheckFor } from "@better-auth/core/db/internal";
+import { runtimeSchemaCheckFor, schemaCheckFor } from "@better-auth/core/db/internal";
 import { socialProviders } from "@better-auth/core/social-providers";
 import { findInvalidTrustedProxies } from "@better-auth/core/utils/ip";
 import { createTelemetry } from "@better-auth/telemetry";
@@ -228,7 +228,8 @@ Most of the features of Better Auth will not work correctly.`);
 	};
 	const initOrPromise = runPluginInit(ctx);
 	if (isPromise(initOrPromise)) await initOrPromise;
-	ctx.checkSchema = schemaCheckFor(ctx.adapter);
+	ctx.checkSchema = runtimeSchemaCheckFor(ctx.adapter);
+	ctx.explicitSchemaCheck = schemaCheckFor(ctx.adapter);
 	return ctx;
 }
 //#endregion

package/dist/crypto/purpose.mjs

@@ -0,0 +1,19 @@
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
+//#region src/crypto/purpose.ts
+const salt = utf8ToBytes("better-auth:oauth-encryption:v1");
+function deriveSecret(secret, purpose) {
+	return bytesToHex(hkdf(sha256, utf8ToBytes(secret), salt, utf8ToBytes(`better-auth:${purpose}:v1`), 32));
+}
+/** Derive an isolated key for one OAuth ciphertext purpose, retaining rotation versions. */
+function derivePurposeKey(secret, purpose) {
+	if (typeof secret === "string") return deriveSecret(secret, purpose);
+	return {
+		keys: new Map(Array.from(secret.keys, ([version, value]) => [version, deriveSecret(value, purpose)])),
+		currentVersion: secret.currentVersion,
+		...secret.legacySecret && { legacySecret: deriveSecret(secret.legacySecret, purpose) }
+	};
+}
+//#endregion
+export { derivePurposeKey };

package/dist/index.mjs

@@ -2,6 +2,7 @@ import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProt
 import { generateGenericState, parseGenericState } from "./state.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
+import "./utils/index.mjs";
 import { APIError } from "./api/index.mjs";
 import { betterAuth } from "./auth/full.mjs";
 import { getCurrentAdapter } from "@better-auth/core/context";

package/dist/oauth2/index.d.mts

@@ -1,5 +1,5 @@
 import { GenerateStateOptions, generateIdTokenNonce, generateState, parseState } from "./state.mjs";
-import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount } from "./link-account.mjs";
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
 export * from "@better-auth/core/oauth2";
-export { GenerateStateOptions, applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };
+export { GenerateStateOptions, applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, linkOAuthAccount, parseState, setTokenUtil };

package/dist/oauth2/index.mjs

@@ -1,5 +1,5 @@
 import { decryptOAuthToken, getOAuthCallbackPath, setTokenUtil } from "./utils.mjs";
-import { applyUpdateUserInfoOnLink, handleOAuthUserInfo } from "./link-account.mjs";
+import { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount } from "./link-account.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./state.mjs";
 export * from "@better-auth/core/oauth2";
-export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, parseState, setTokenUtil };
+export { applyUpdateUserInfoOnLink, decryptOAuthToken, generateIdTokenNonce, generateState, getOAuthCallbackPath, handleOAuthUserInfo, linkOAuthAccount, parseState, setTokenUtil };

package/dist/oauth2/link-account.d.mts

@@ -2,9 +2,49 @@ import { Account, User } from "../types/models.mjs";
 import { GenericEndpointContext, UserProvisioningSource } from "@better-auth/core";
 
 //#region src/oauth2/link-account.d.ts
+type OAuthAccountData = Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+/**
+ * Provider profile a freshly linked account may copy onto the local user.
+ * `email` and `emailVerified` are identity anchors and are stripped before
+ * the remaining fields are written. Provider identity is resolved separately
+ * from the raw profile through the provider's account-key contract.
+ */
+type LinkedProviderProfile = {
+  name?: string | undefined;
+  email?: string | null | undefined;
+  emailVerified?: boolean | undefined;
+  image?: string | null | undefined;
+};
+interface LinkOAuthAccountOptions {
+  link: {
+    userId: string;
+    email: string;
+  };
+  userInfo: LinkedProviderProfile;
+  account: OAuthAccountData;
+  profile: Record<string, unknown>;
+  scopes?: string[] | undefined;
+}
+interface LinkOAuthAccountFailure {
+  linked: false;
+  error: {
+    code: string;
+    message?: string | undefined;
+  };
+}
+type LinkOAuthAccountResult = {
+  linked: true;
+} | LinkOAuthAccountFailure;
+declare function linkOAuthAccount(c: GenericEndpointContext, {
+  link,
+  userInfo,
+  account,
+  profile,
+  scopes
+}: LinkOAuthAccountOptions): Promise<LinkOAuthAccountResult>;
 declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
   userInfo: Omit<User, "createdAt" | "updatedAt">;
-  account: Omit<Account, "id" | "userId" | "createdAt" | "updatedAt">;
+  account: OAuthAccountData;
   callbackURL?: string | undefined;
   disableSignUp?: boolean | undefined;
   overrideUserInfo?: boolean | undefined;
@@ -67,18 +107,6 @@ declare function handleOAuthUserInfo(c: GenericEndpointContext, opts: {
     password?: string | null | undefined;
   } | null;
 }>;
-/**
- * Provider profile a freshly linked account may copy onto the local user.
- * `email` and `emailVerified` are identity anchors and are stripped before
- * the remaining fields are written. Provider identity is resolved separately
- * from the raw profile through the provider's account-key contract.
- */
-type LinkedProviderProfile = {
-  name?: string | undefined;
-  email?: string | null | undefined;
-  emailVerified?: boolean | undefined;
-  image?: string | null | undefined;
-};
 /**
  * Apply the `account.accountLinking.updateUserInfoOnLink` policy: when enabled,
  * copy the freshly linked provider's profile onto the local user, matching the
@@ -93,4 +121,4 @@ type LinkedProviderProfile = {
  */
 declare function applyUpdateUserInfoOnLink(c: GenericEndpointContext, userId: string, userInfo: LinkedProviderProfile): Promise<User | undefined>;
 //#endregion
-export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount };

package/dist/oauth2/link-account.mjs

@@ -8,7 +8,67 @@ import { createEmailVerificationToken } from "../api/routes/email-verification.m
 import { queueAfterTransactionHook, runWithTransaction } from "@better-auth/core/context";
 import { isDevelopment } from "@better-auth/core/env";
 import { APIError } from "@better-auth/core/error";
+import { mergeScopes } from "@better-auth/core/oauth2";
 //#region src/oauth2/link-account.ts
+function linkOAuthAccountFailure(code, message) {
+	return {
+		linked: false,
+		error: {
+			code,
+			message
+		}
+	};
+}
+async function linkOAuthAccount(c, { link, userInfo, account, profile, scopes }) {
+	try {
+		await assertValidUserInfo(c, {
+			user: {
+				...userInfo,
+				id: link.userId,
+				email: userInfo.email ?? void 0
+			},
+			source: {
+				action: "link-account",
+				method: "oauth",
+				oauth: {
+					providerId: account.providerId,
+					profile
+				}
+			}
+		});
+	} catch (error) {
+		if (!isAPIError(error) || !error.body?.code) throw error;
+		return linkOAuthAccountFailure(error.body.code, error.body.message);
+	}
+	if (!c.context.trustedProviders.includes(account.providerId) && !userInfo.emailVerified || c.context.options.account?.accountLinking?.enabled === false) {
+		c.context.logger.error("Unable to link account - untrusted provider");
+		return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
+	}
+	if (userInfo.email?.toLowerCase() !== link.email.toLowerCase() && c.context.options.account?.accountLinking?.allowDifferentEmails !== true) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.EMAIL_DOES_NOT_MATCH);
+	const existingAccount = await c.context.internalAdapter.findAccountByKey(account);
+	if (existingAccount) {
+		if (existingAccount.userId.toString() !== link.userId.toString()) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.ACCOUNT_ALREADY_LINKED_TO_DIFFERENT_USER);
+		const mergedScope = mergeScopes(existingAccount.scope, scopes);
+		const updateData = Object.fromEntries(Object.entries({
+			providerId: account.providerId,
+			accessToken: await setTokenUtil(account.accessToken, c.context),
+			refreshToken: await setTokenUtil(account.refreshToken, c.context),
+			idToken: account.idToken,
+			accessTokenExpiresAt: account.accessTokenExpiresAt,
+			refreshTokenExpiresAt: account.refreshTokenExpiresAt,
+			scope: mergedScope || void 0
+		}).filter(([_, value]) => value !== void 0));
+		await c.context.internalAdapter.updateAccount(existingAccount.id, updateData);
+	} else if (!await c.context.internalAdapter.createAccount({
+		userId: link.userId,
+		...account,
+		accessToken: await setTokenUtil(account.accessToken, c.context),
+		refreshToken: await setTokenUtil(account.refreshToken, c.context),
+		scope: scopes?.join(",") ?? account.scope
+	})) return linkOAuthAccountFailure(OAUTH_CALLBACK_ERROR_CODES.UNABLE_TO_LINK_ACCOUNT);
+	await applyUpdateUserInfoOnLink(c, link.userId, userInfo);
+	return { linked: true };
+}
 async function handleOAuthUserInfo(c, opts) {
 	const { userInfo, account, callbackURL, disableSignUp, overrideUserInfo } = opts;
 	const source = opts.source ?? {
@@ -326,4 +386,4 @@ async function applyUpdateUserInfoOnLink(c, userId, userInfo) {
 	}
 }
 //#endregion
-export { applyUpdateUserInfoOnLink, handleOAuthUserInfo };
+export { applyUpdateUserInfoOnLink, handleOAuthUserInfo, linkOAuthAccount };

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.5";
+var version = "1.7.7";
 //#endregion
 export { version };