better-auth 1.7.6 → 1.7.7

package/dist/api/rate-limiter/index.mjs

@@ -65,7 +65,10 @@ function rateLimitResponse(retryAfter) {
 	return new Response(JSON.stringify({ message: "Too many requests. Please try again later." }), {
 		status: 429,
 		statusText: "Too Many Requests",
-		headers: { "X-Retry-After": retryAfter.toString() }
+		headers: {
+			"Content-Type": "application/json",
+			"X-Retry-After": retryAfter.toString()
+		}
 	});
 }
 function getRetryAfter(lastRequest, window) {

package/dist/api/routes/sign-in.mjs

@@ -10,6 +10,7 @@ import { generateIdTokenNonce, generateState } from "../../oauth2/state.mjs";
 import { safeCloneRequest } from "../../utils/request.mjs";
 import { createEmailVerificationToken } from "./email-verification.mjs";
 import { assertPasswordNotTooLong } from "../../utils/password.mjs";
+import "../../utils/index.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { additionalAuthorizationParamsSchema, supportsIdTokenSignIn, verifyProviderIdToken } from "@better-auth/core/oauth2";
 import { SocialProviderListEnum } from "@better-auth/core/social-providers";
@@ -193,7 +194,7 @@ const signInSocial = () => createAuthEndpoint("/sign-in/social", {
 				idToken: token
 			},
 			callbackURL: c.body.callbackURL,
-			disableSignUp: provider.disableImplicitSignUp && !c.body.requestSignUp || provider.disableSignUp,
+			disableSignUp: provider.disableImplicitSignUp && !c.body.requestSignUp || provider.options?.disableSignUp || provider.disableSignUp,
 			source: {
 				method: "oauth",
 				oauth: {

package/dist/client/config.mjs

@@ -19,6 +19,7 @@ const resolvePublicAuthUrl = (basePath) => {
 		} catch {}
 	}
 };
+const matchesSessionSignal = (path) => path === "/sign-out" || path === "/update-user" || path === "/update-session" || path === "/sign-up/email" || path === "/sign-in/email" || path === "/delete-user" || path === "/verify-email" || path === "/revoke-sessions" || path === "/revoke-session" || path === "/revoke-other-sessions" || path === "/change-email" || path === "/change-password";
 const getClientConfig = (options, loadEnv) => {
 	const isCredentialsSupported = "credentials" in Request.prototype;
 	const baseURL = getBaseURL(options?.baseURL, options?.basePath, void 0, loadEnv) ?? resolvePublicAuthUrl(options?.basePath) ?? "/api/auth";
@@ -72,9 +73,7 @@ const getClientConfig = (options, loadEnv) => {
 	};
 	const atomListeners = [{
 		signal: "$sessionSignal",
-		matcher(path) {
-			return path === "/sign-out" || path === "/update-user" || path === "/update-session" || path === "/sign-up/email" || path === "/sign-in/email" || path === "/delete-user" || path === "/verify-email" || path === "/revoke-sessions" || path === "/revoke-session" || path === "/revoke-other-sessions" || path === "/change-email" || path === "/change-password";
-		},
+		matcher: matchesSessionSignal,
 		callback(path) {
 			if (path === "/sign-out") broadcastSessionUpdate("signout");
 			else if (path === "/update-user" || path === "/update-session") broadcastSessionUpdate("updateUser");
@@ -110,4 +109,4 @@ const getClientConfig = (options, loadEnv) => {
 	};
 };
 //#endregion
-export { getClientConfig };
+export { getClientConfig, matchesSessionSignal };

package/dist/crypto/purpose.mjs

@@ -0,0 +1,19 @@
+import { hkdf } from "@noble/hashes/hkdf.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
+//#region src/crypto/purpose.ts
+const salt = utf8ToBytes("better-auth:oauth-encryption:v1");
+function deriveSecret(secret, purpose) {
+	return bytesToHex(hkdf(sha256, utf8ToBytes(secret), salt, utf8ToBytes(`better-auth:${purpose}:v1`), 32));
+}
+/** Derive an isolated key for one OAuth ciphertext purpose, retaining rotation versions. */
+function derivePurposeKey(secret, purpose) {
+	if (typeof secret === "string") return deriveSecret(secret, purpose);
+	return {
+		keys: new Map(Array.from(secret.keys, ([version, value]) => [version, deriveSecret(value, purpose)])),
+		currentVersion: secret.currentVersion,
+		...secret.legacySecret && { legacySecret: deriveSecret(secret.legacySecret, purpose) }
+	};
+}
+//#endregion
+export { derivePurposeKey };

package/dist/index.mjs

@@ -2,6 +2,7 @@ import { getBaseURL, getHost, getHostFromSource, getOrigin, getProtocol, getProt
 import { generateGenericState, parseGenericState } from "./state.mjs";
 import { generateIdTokenNonce, generateState, parseState } from "./oauth2/state.mjs";
 import { HIDE_METADATA } from "./utils/hide-metadata.mjs";
+import "./utils/index.mjs";
 import { APIError } from "./api/index.mjs";
 import { betterAuth } from "./auth/full.mjs";
 import { getCurrentAdapter } from "@better-auth/core/context";

package/dist/package.mjs

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "1.7.6";
+var version = "1.7.7";
 //#endregion
 export { version };

package/dist/plugins/magic-link/index.mjs

@@ -23,6 +23,20 @@ const magicLinkVerifyQuerySchema = z.object({
 	errorCallbackURL: z.string().meta({ description: "URL to redirect after error." }).optional(),
 	newUserCallbackURL: z.string().meta({ description: "URL to redirect after new user signup. Only used if the user is registering for the first time." }).optional()
 });
+const magicLinkRecordSchema = z.object({
+	type: z.literal("magic-link"),
+	email: z.email(),
+	name: z.string().optional()
+}).strict();
+function parseMagicLinkRecord(value) {
+	try {
+		const parsed = JSON.parse(value);
+		return magicLinkRecordSchema.safeParse(parsed);
+	} catch {
+		return null;
+	}
+}
+const magicLinkIdentifier = (storedToken) => `magic-link:${storedToken}`;
 const magicLink = (options) => {
 	const opts = {
 		storeToken: "plain",
@@ -75,8 +89,9 @@ const magicLink = (options) => {
 				const verificationToken = opts?.generateToken ? await opts.generateToken(email) : generateRandomString(32, "a-z", "A-Z");
 				const storedToken = await storeToken(ctx, verificationToken);
 				await ctx.context.internalAdapter.createVerificationValue({
-					identifier: storedToken,
+					identifier: magicLinkIdentifier(storedToken),
 					value: JSON.stringify({
+						type: "magic-link",
 						email,
 						name: ctx.body.name
 					}),
@@ -152,10 +167,14 @@ const magicLink = (options) => {
 					throw ctx.redirect(errorCallbackURL.toString());
 				}
 				const newUserCallbackURL = new URL(ctx.query.newUserCallbackURL ? decodeURIComponent(ctx.query.newUserCallbackURL) : callbackURL, ctx.context.baseURL).toString();
-				const storedToken = await storeToken(ctx, token);
-				const tokenValue = await ctx.context.internalAdapter.consumeVerificationValue(storedToken);
+				const identifier = magicLinkIdentifier(await storeToken(ctx, token));
+				const pendingValue = await ctx.context.internalAdapter.findVerificationValue(identifier);
+				if (!pendingValue || !parseMagicLinkRecord(pendingValue.value)?.success) redirectWithError("INVALID_TOKEN");
+				const tokenValue = await ctx.context.internalAdapter.consumeVerificationValue(identifier);
 				if (!tokenValue) redirectWithError("INVALID_TOKEN");
-				const { email, name } = JSON.parse(tokenValue.value);
+				const record = parseMagicLinkRecord(tokenValue.value);
+				if (!record?.success) redirectWithError("INVALID_TOKEN");
+				const { email, name } = record.data;
 				let isNewUser = false;
 				let user = await ctx.context.internalAdapter.findUserByEmail(email).then((res) => res?.user);
 				if (!user) if (!opts.disableSignUp) {

package/dist/plugins/oauth-proxy/index.d.mts

@@ -41,12 +41,11 @@ interface OAuthProxyOptions {
    * A dedicated secret used to encrypt and decrypt data passed between
    * servers during the OAuth proxy flow.
    *
-   * When set, this secret is used **instead of** the global
-   * `BETTER_AUTH_SECRET` for all OAuth proxy encryption operations.
-   * This limits the blast radius if the secret is shared across
-   * environments (production, preview, development): a leaked proxy
-   * secret cannot be used to forge sessions or decrypt other data
-   * protected by the main secret.
+   * When set, keys derived from this secret are used **instead of** keys
+   * derived from `BETTER_AUTH_SECRET` for OAuth proxy encryption.
+   * This limits exposure of data protected only by the main secret if
+   * the proxy secret is shared across environments (production, preview,
+   * development). A compromised proxy secret can still affect OAuth flows.
    *
    * All environments participating in the OAuth proxy flow must share
    * the same `secret` value.

package/dist/plugins/oauth-proxy/index.mjs

@@ -9,7 +9,8 @@ import { redirectOnError } from "../../oauth2/errors.mjs";
 import { getOAuthCallbackPath } from "../../oauth2/utils.mjs";
 import { handleOAuthUserInfo, linkOAuthAccount } from "../../oauth2/link-account.mjs";
 import { setOAuthState } from "../../api/state/oauth.mjs";
-import { parseGenericState } from "../../state.mjs";
+import { derivePurposeKey } from "../../crypto/purpose.mjs";
+import { getAuthStateVerificationIdentifier, parseGenericState } from "../../state.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { parseJSON } from "../../client/parser.mjs";
 import { checkSkipProxy, resolveCurrentURL, stripTrailingSlash } from "./utils.mjs";
@@ -66,7 +67,7 @@ const oauthCallbackQuerySchema = z.object({
 });
 const oAuthProxy = (opts) => {
 	const maxAge = opts?.maxAge ?? 60;
-	const getEncryptionKey = (ctx) => opts?.secret ?? ctx.context.secretConfig;
+	const getEncryptionKey = (ctx, purpose) => derivePurposeKey(opts?.secret ?? ctx.context.secretConfig, purpose);
 	const oauthProxyCompletion = createAuthEndpoint("/callback/:id/oauth-proxy", {
 		method: "GET",
 		operationId: "oauthProxyCompletion",
@@ -84,7 +85,7 @@ const oAuthProxy = (opts) => {
 		let decryptedPayload;
 		try {
 			decryptedPayload = await symmetricDecrypt({
-				key: getEncryptionKey(ctx),
+				key: getEncryptionKey(ctx, "oauth-proxy-profile"),
 				data: encryptedProfile
 			});
 		} catch (e) {
@@ -225,7 +226,7 @@ const oAuthProxy = (opts) => {
 					let statePackage;
 					try {
 						statePackage = parseJSON(await symmetricDecrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-package"),
 							data: state
 						}));
 					} catch {
@@ -245,7 +246,7 @@ const oAuthProxy = (opts) => {
 					let stateData;
 					try {
 						stateData = parseJSON(await symmetricDecrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-state"),
 							data: statePackage.stateCookie
 						}));
 					} catch (e) {
@@ -338,7 +339,7 @@ const oAuthProxy = (opts) => {
 						timestamp: Date.now()
 					};
 					const encryptedPayload = await symmetricEncrypt({
-						key: getEncryptionKey(ctx),
+						key: getEncryptionKey(ctx, "oauth-proxy-profile"),
 						data: JSON.stringify(payload)
 					});
 					proxyCallbackURL.searchParams.set("profile", encryptedPayload);
@@ -366,11 +367,11 @@ const oAuthProxy = (opts) => {
 								const oauthStateCookie = ctx.context.createAuthCookie("oauth_state");
 								const encryptedCookieValue = parseSetCookieHeader(setCookieHeader).get(oauthStateCookie.name)?.value;
 								if (encryptedCookieValue) plaintextState = await symmetricDecrypt({
-									key: ctx.context.secretConfig,
+									key: derivePurposeKey(ctx.context.secretConfig, "oauth-state-cookie"),
 									data: encryptedCookieValue
 								});
 							}
-						} else plaintextState = (await ctx.context.internalAdapter.findVerificationValue(originalState))?.value;
+						} else plaintextState = (await ctx.context.internalAdapter.findVerificationValue(getAuthStateVerificationIdentifier(originalState)))?.value;
 						if (!plaintextState) {
 							ctx.context.logger.warn("No OAuth state found for proxy");
 							return;
@@ -378,13 +379,13 @@ const oAuthProxy = (opts) => {
 						const statePackage = {
 							state: originalState,
 							stateCookie: await symmetricEncrypt({
-								key: getEncryptionKey(ctx),
+								key: getEncryptionKey(ctx, "oauth-proxy-state"),
 								data: plaintextState
 							}),
 							isOAuthProxy: true
 						};
 						const encryptedPackage = await symmetricEncrypt({
-							key: getEncryptionKey(ctx),
+							key: getEncryptionKey(ctx, "oauth-proxy-package"),
 							data: JSON.stringify(statePackage)
 						});
 						oauthURL.searchParams.set("state", encryptedPackage);

package/dist/plugins/open-api/index.mjs

@@ -1,4 +1,5 @@
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
+import "../../utils/index.mjs";
 import { APIError } from "../../api/index.mjs";
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { generator } from "./generator.mjs";

package/dist/plugins/organization/client.mjs

@@ -1,5 +1,6 @@
 import { PACKAGE_VERSION } from "../../version.mjs";
 import { useAuthQuery } from "../../client/query.mjs";
+import { matchesSessionSignal } from "../../client/config.mjs";
 import { adminAc, defaultRoles, memberAc, ownerAc } from "./access/statement.mjs";
 import { ORGANIZATION_ERROR_CODES } from "./error-codes.mjs";
 import { hasPermissionFn } from "./permission.mjs";
@@ -71,7 +72,7 @@ const organizationClient = (options) => {
 			},
 			{
 				matcher(path) {
-					return path === "/sign-out" || path.startsWith("/organization");
+					return matchesSessionSignal(path) || path.startsWith("/organization");
 				},
 				signal: "$activeOrgSignal"
 			},

package/dist/plugins/phone-number/routes.mjs

@@ -5,6 +5,7 @@ import { setSessionCookie } from "../../cookies/index.mjs";
 import { getSessionFromCtx } from "../../api/routes/session.mjs";
 import { HIDE_METADATA } from "../../utils/hide-metadata.mjs";
 import { assertPasswordNotTooLong, assertPasswordNotTooShort } from "../../utils/password.mjs";
+import "../../utils/index.mjs";
 import { PHONE_NUMBER_ERROR_CODES } from "./error-codes.mjs";
 import { APIError, BASE_ERROR_CODES } from "@better-auth/core/error";
 import { createAuthEndpoint } from "@better-auth/core/api";

package/dist/state.mjs

@@ -1,6 +1,7 @@
 import { generateRandomString } from "./crypto/random.mjs";
 import { symmetricDecrypt, symmetricEncrypt } from "./crypto/index.mjs";
 import { expireCookie } from "./cookies/index.mjs";
+import { derivePurposeKey } from "./crypto/purpose.mjs";
 import { BetterAuthError } from "@better-auth/core/error";
 import * as z from "zod";
 //#region src/state.ts
@@ -32,6 +33,8 @@ const stateDataSchema = z.looseObject({
 	*/
 	serverContext: z.record(z.string(), z.unknown()).optional()
 });
+/** Verification key for database-backed OAuth and SAML relay state. */
+const getAuthStateVerificationIdentifier = (state) => `auth-state:${state}`;
 const INTERNAL_STATE_KEYS = new Set(Object.keys(stateDataSchema.shape));
 var StateError = class extends BetterAuthError {
 	code;
@@ -59,7 +62,7 @@ async function generateGenericState(c, stateData, settings) {
 			oauthState: state
 		};
 		const encryptedData = await symmetricEncrypt({
-			key: c.context.secretConfig,
+			key: derivePurposeKey(c.context.secretConfig, "oauth-state-cookie"),
 			data: JSON.stringify(payload)
 		});
 		const stateCookie = c.context.createAuthCookie(settings?.cookieName ?? "oauth_state", { maxAge: 600 });
@@ -78,7 +81,7 @@ async function generateGenericState(c, stateData, settings) {
 			...stateData,
 			oauthState: state
 		}),
-		identifier: state,
+		identifier: getAuthStateVerificationIdentifier(state),
 		expiresAt
 	})) throw new StateError("Unable to create verification. Make sure the database adapter is properly working and there is a verification table in the database", { code: "state_generation_error" });
 	return {
@@ -99,7 +102,7 @@ async function parseGenericState(c, state, settings) {
 		});
 		try {
 			const decryptedData = await symmetricDecrypt({
-				key: c.context.secretConfig,
+				key: derivePurposeKey(c.context.secretConfig, "oauth-state-cookie"),
 				data: encryptedData
 			});
 			parsedData = stateDataSchema.parse(JSON.parse(decryptedData));
@@ -117,7 +120,7 @@ async function parseGenericState(c, state, settings) {
 		});
 		expireCookie(c, stateCookie);
 	} else {
-		const data = await c.context.internalAdapter.findVerificationValue(state);
+		const data = await c.context.internalAdapter.findVerificationValue(getAuthStateVerificationIdentifier(state));
 		if (!data) throw new StateError("State mismatch: verification not found", {
 			code: "state_mismatch",
 			details: { state }
@@ -136,7 +139,7 @@ async function parseGenericState(c, state, settings) {
 			errorURL: parsedData.errorURL
 		});
 		expireCookie(c, stateCookie);
-		await c.context.internalAdapter.deleteVerificationByIdentifier(state);
+		await c.context.internalAdapter.deleteVerificationByIdentifier(getAuthStateVerificationIdentifier(state));
 	}
 	if (parsedData.expiresAt < Date.now()) throw new StateError("Invalid state: request expired", {
 		code: "state_mismatch",
@@ -146,4 +149,4 @@ async function parseGenericState(c, state, settings) {
 	return parsedData;
 }
 //#endregion
-export { INTERNAL_STATE_KEYS, StateError, generateGenericState, parseGenericState };
+export { INTERNAL_STATE_KEYS, StateError, generateGenericState, getAuthStateVerificationIdentifier, parseGenericState };

package/dist/utils/hashing.mjs

@@ -1,5 +1,5 @@
-import { keccak_256 } from "@noble/hashes/sha3.js";
 import { utf8ToBytes } from "@noble/hashes/utils.js";
+import { keccak_256 } from "@noble/hashes/sha3.js";
 //#region src/utils/hashing.ts
 /**
 * TS implementation of ERC-55 ("Mixed-case checksum address encoding") using @noble/hashes

package/dist/utils/index.mjs

@@ -0,0 +1,5 @@
+import "./url.mjs";
+import "../state.mjs";
+import "../oauth2/state.mjs";
+import "./hide-metadata.mjs";
+export {};

package/dist/utils/middleware-response.mjs

@@ -2,6 +2,9 @@
 const middlewareResponse = ({ message, status, code }) => ({ response: new Response(JSON.stringify({
 	message,
 	code
-}), { status }) });
+}), {
+	status,
+	headers: { "Content-Type": "application/json" }
+}) });
 //#endregion
 export { middlewareResponse };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-auth",
-  "version": "1.7.6",
+  "version": "1.7.7",
   "description": "The most comprehensive authentication framework for TypeScript.",
   "type": "module",
   "license": "MIT",
@@ -473,13 +473,13 @@
     "kysely": "^0.28.17 || ^0.29.0",
     "nanostores": "^1.3.0",
     "zod": "^4.5.4",
-    "@better-auth/core": "1.7.6",
-    "@better-auth/drizzle-adapter": "1.7.6",
-    "@better-auth/kysely-adapter": "1.7.6",
-    "@better-auth/memory-adapter": "1.7.6",
-    "@better-auth/mongo-adapter": "1.7.6",
-    "@better-auth/prisma-adapter": "1.7.6",
-    "@better-auth/telemetry": "1.7.6"
+    "@better-auth/core": "1.7.7",
+    "@better-auth/drizzle-adapter": "1.7.7",
+    "@better-auth/kysely-adapter": "1.7.7",
+    "@better-auth/memory-adapter": "1.7.7",
+    "@better-auth/mongo-adapter": "1.7.7",
+    "@better-auth/prisma-adapter": "1.7.7",
+    "@better-auth/telemetry": "1.7.7"
   },
   "devDependencies": {
     "@lynx-js/react": "^0.121.2",